FreeDR Wiki

FreeDR is a free, local endpoint detection and response (EDR) agent for a single Windows 10 or 11 computer and its one local user. It collects process, registry, file, USN journal, Windows Event Log (including Sysmon) and file-artifact evidence into a local DuckDB store, runs 345 built-in SQL detection rules, groups alerts into cases, and can optionally use an AI investigator to triage cases. Everything runs on the machine; the console is served only on http://127.0.0.1:29173/.

Section	What it covers
Feature list	Every feature, one line each
Getting started	Requirements, installing, first sign-in, upgrading, uninstalling
Data sources	What each source collects, event types, noise controls, storage
Configuration	All optional settings: agent config, Sources, retention, providers, notifications
Rules	Built-in rule pack, rule catalog, writing rules, exclusions and mutes
Alerts & Cases	How alerts are created, case grouping, closure, resolution, enrichment
AI features	Providers, models, thinking, investigation, exclusion proposals, web research, guardrails
Miscellaneous	Hunt, Response actions, Health, Security, Console tour, Troubleshooting

This wiki describes the code on main at commit fcfd49b. Anything partial or not yet available is labelled on its page.