I just mean to say that while you absolutely should work to configure the OS to a reasonable baseline of security, you also still need a real EDR product on top of it.

Even if security were "solved" in Linux (it's not), it would still often be illegal not to have an EDR and that's probably a good thing.

> you also still need a real EDR product on top of it.

Well that's my point. You don't need third-party software messing up with the OS internals, when the same thing can be provided by the OS directly. The real EDR product is the OS.