Who does what
Provider
- Investigate contracted Fusion alerts
- Hunt emerging threats
- Perform protocol-authorized containment
Your team
- Maintain licenses and connectivity
- Define permissions and approve changes
- Lead incidents and wider recovery
Coverage
- Endpoints
Details
Service scope
Best for Teams with supported endpoint tools and an internal incident owner
Fusion service
The exact offer is MDR Elite on Fusion under LevelBlue. Other family platforms and Microsoft co-managed services have separate scope.
Managed data
Contracted applications receive detection. Other ingested logs may not. Volume caps can mean additional charges or throttling.
Response boundary
Endpoint permissions and emergency policy terms define authority. You retain incident leadership and broader recovery.
Full service analysis
LevelBlue's Trustwave MDR Elite investigates Fusion alerts 24/7 and contains endpoint threats under customer-defined response protocols. You retain incident leadership, technology upkeep and remediation or recovery beyond the agreed actions.
- Your team owns
- Maintain product licenses, agents, connectivity and authorized contacts
- Define response protocols and approve required changes
- Lead incidents and arrange wider remediation, recovery or DFIR
LevelBlue ownership
LevelBlue acquired Trustwave in August 2025. This profile covers the Fusion-based MDR Elite contract. Alert Logic's subscriptions and Cybereason's MDR contracts remain separate scopes to evaluate, while a generic LevelBlue MDR name should not be counted as another independent provider.
Managed sources and cost
The contract includes only named managed applications and supported event sources. Non-EDR ingestion has volume allowances, and excess traffic can incur fees or be throttled. Additional EDR or SIEM logs outside the agreement do not automatically receive threat detection.
Response and recovery
Endpoint response follows the agreed protocol, with separate approval for red or undefined endpoints. Emergency policy changes have distinct terms. The buyer retains incident management and mitigation responsibilities, while broader digital forensics and incident response can require another engagement.
Pricing & contract
- Billing
- Custom
Contracted endpoint quantity, non-EDR event volume, managed applications and investigation entitlements determine scope. Data-volume overages can add cost or result in throttling.
Tradeoffs & buying questions
Strengths
-
Several supported endpoint platforms
Supports several established endpoint security platforms
-
Permissions per endpoint or group
Defines response authority per endpoint or endpoint group
-
Incident and change visibility in Fusion
Gives buyers incident and change-ticket visibility in Fusion
Considerations
-
Raw ingestion does not establish detection
Ingested logs outside managed scope do not imply detection
-
Volume and retrieval can add costs
Data-volume caps and historical retrieval can add cost
-
Wider DFIR and recovery need separate ownership
Incident leadership and wider DFIR remain separately assigned
Ask before buying
- Which endpoint technologies and non-EDR sources are managed for detection, and what event-volume caps or throttling apply?
- How do red, yellow and green response permissions interact with emergency policy changes for our critical assets?
- Which seller owns delivery and renewal, and what remote-investigation, retention and wider DFIR entitlements are included?
Integrations
Endpoint
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
- SentinelOne Singularity Complete
2 more integrations
- Palo Alto Cortex XDR
- VMware Carbon Black EDR
Other integrations
- Trustwave Fusion
Common questions
Is Trustwave MDR Elite now part of LevelBlue?
Yes. LevelBlue acquired Trustwave in August 2025. Confirm that your order names the Fusion-based MDR Elite service and identifies the seller, delivery team and renewal terms.
Will the service take action on every endpoint automatically?
No. The response protocol distinguishes endpoints with broad preapproval, a limited approved action set or explicit approval requirements. Emergency policy changes have separate terms that should be reviewed.