Who does what
Provider
- Investigate endpoint detections
- Hunt for threats
- Execute authorized endpoint actions
Your team
- Maintain endpoint deployment and access
- Approve isolation in writing
- Arrange wider response and recovery
Coverage
- Endpoints
Details
Service scope
Best for Cybereason users with an incident owner available to approve isolation
Current offer
Complete has its own service description under LevelBlue. Confirm the contract, delivery team and platform at new sale or renewal.
Endpoint actions
Defined remediation is included. Host isolation requires written consent, while common remediation applies across sensors.
Wider incidents
External-log analysis, broader forensics, crisis management and recovery need a separate engagement.
Full service analysis
Cybereason MDR Complete investigates endpoint threats and performs specified remediation through the Cybereason platform. You approve each host-isolation request in writing and retain wider incident response and recovery. The service is now owned by LevelBlue.
- Your team owns
- Maintain endpoint deployment, required access and reachable incident contacts
- Give written host-isolation instructions and other required authorizations
- Arrange wider forensics, incident management and recovery
LevelBlue transition
LevelBlue acquired Cybereason in November 2025. Complete still has a distinct published service description and reseller listings, while the former marketing page redirects to LevelBlue MDR. Confirm which contract, platform and delivery team your new order or renewal will use.
Response permission
Complete includes defined endpoint remediation, but host isolation requires written consent identifying the machines for that incident. The description applies common remediation across all sensors rather than a custom subset. Review critical-system exceptions and severity triggers before onboarding.
Separate incident response
The service works within Cybereason platform detections. Root-cause analysis, external-log analysis, digital forensics, crisis management and guided disaster recovery fall outside the MDR description and require a separate professional-services agreement.
Pricing & contract
- Billing
- Per-endpoint, Custom
The quote defines authorized endpoints and software entitlements. Confirm the Complete package, subscription term, minimum quantity and separate incident-response charges.
Tradeoffs & buying questions
Strengths
-
Native investigation and defined response
Combines native endpoint investigation with active remediation
-
Buyer approval for host isolation
Keeps host-isolation decisions with the buyer
-
Proactive hunting and reporting
Includes proactive hunting and service reporting
Considerations
-
Cybereason sensor and platform requirement
Requires Cybereason sensors and the applicable platform entitlement
-
Common remediation applies across sensors
Common remediation is not scoped to a custom endpoint subset
-
Wider forensics and recovery are separate
Broader forensics and recovery require separate services
Ask before buying
- Does the quote retain the Cybereason MDR Complete contract, and who owns delivery, support, renewal and any platform migration?
- What actions start automatically, what severity and timing rules apply, and how will we approve host isolation out of hours?
- Which software licenses, endpoint quantities and term are included, and how is wider incident response charged?
Integrations
Endpoint
- Cybereason EDR
Other integrations
- Cybereason Defense Platform
Common questions
Is MDR Complete the same as MDR Essentials?
No. The published Essentials description centers on monitoring, investigation and response recommendations. Complete adds proactive hunting and defined managed-response work. Ensure the quote names the intended tier.
Can Cybereason isolate a machine without asking?
The Complete description requires written consent for specific machines and the incident before host isolation. Other defined remediation actions follow the service's authorization rules.