Open Source EDR for free
You can use the cloud hosted version on the Xcitium platform for unlimited endpoints (comes with 3 day storage for free.)
You can watch the onboarding video here.
Of course if you want to run it with your own ELK …you can set it all up with whatever storage you want locally.