LevelBlue (Cybereason)

Primary DomainEndpoint Detection & Threat Hunting

HeadquartersDallas, Texas & Boston, Massachusetts, USA

Founded2012

DeploymentCloud-Native Hunting Platform, Cross-Platform Endpoint Sensor

Vendor & Platform Overview

Cybereason (operating under LevelBlue, the joint strategic cybersecurity venture with AT&T) is recognized for its cross-machine correlation engine designed to reverse the adversary advantage. By contextualizing atomic endpoint events into unified, malicious operations (Malops), Cybereason enables threat hunters and incident responders to intercept multi-stage intrusions before data exfiltration occurs.

Architecture & Detection Telemetry

Cybereason's engine is powered by an in-memory graph correlation engine capable of processing up to 8 million events per second per server. The local endpoint sensor passively observes OS behaviors with minimal CPU footprint, streaming event trees to the Cybereason hunting engine where the Malop Hunting Engine stitches disjointed events across thousands of machines into a single attack storyline.

Mitigated Threat Types & Incident Playbooks

Targeted malware classifications and primary attack vectors defended by LevelBlue (Cybereason)'s security stack:

Multi-Stage Ransomware Operations →Advanced In-Memory RAT Infiltration →Kerberos & NTLM Credential Compromise →Living-off-the-Land Command Execution →

SOC Incident Response & Containment Workflow

Recommended operational sequence for security operations teams triaging alerts generated by LevelBlue (Cybereason):

When a Malop alert triggers, responders open the interactive attack tree to identify the root compromise process and every impacted machine. Responders execute one-click Malop remediation: killing malicious processes across all endpoints simultaneously, quarantining payload binaries, preventing registry persistence, and network-isolating infected hosts with a single operational action.

Enterprise Security Products

Cybereason Defense Platform
Cybereason XDR

Other Products & Solutions

Non-catalog offerings, enterprise IT platforms, and consumer productivity solutions provided by LevelBlue (Cybereason):

LevelBlue Managed Security Services (24/7 Managed NOC and SOC infrastructure monitoring)
Strategic Cyber Risk Consulting & Governance Advisory
Digital Forensics & Incident Response (DFIR) Retainer Engagements
Regulatory Compliance Readiness (PCI-DSS, HIPAA, ISO 27001 readiness audits)

Frequently Asked Questions

What is a Cybereason Malop?

A Malop (Malicious Operation) is Cybereason's presentation of an entire attack chain. Rather than flooding analysts with dozens of isolated alerts, Cybereason correlates related process injections, network connections, and privilege escalations into a single actionable visual incident.

How does Cybereason stop fileless and memory-based malware?

Cybereason monitors execution flows within system memory, detecting techniques such as Process Hollowing, reflective DLL loading, and malicious PowerShell commands without relying on disk-based file signatures.

Can Cybereason remediate attacks across multiple machines simultaneously?

Yes. Cybereason allows responders to select a Malop and apply remediation across all involved hosts at once, terminating processes, cleaning registry keys, and isolating devices in parallel.