<t>You can run DFE in passive mode, get all the telemetry etc and keep crowd strike as your EDR solution. <br/>
<br/>
<br/>
DFE and it's associated products (identity, cloud apps, sentinel etc) require way more tuning to suppress the noise than CS. At least that's my experience working in an MSSP.</t>
