Services Description
MDR Essentials

The MDR Services described herein are subject to the License and Services Agreement located at https://www.cybereason.com/license-agreement, unless the customer receiving the services (“Customer”) has executed a different license and services agreement, in which case the executed version shall supersede, (the “Agreement”). In the event of any conflict between the terms hereof and the Agreement, the terms hereof shall control.

Cybereason shall provide those services listed below subject to the terms of the Agreement, provided that in the event of any conflict between the terms hereof and the Agreement, the terms hereof shall control. Customer’s order of MDR Services shall be specifically designated in the applicable Quote.

1. MDE Essentials Services Descriptions. Cybereason shall provide Managed Detection and Response (“MDR”) services on Customer’s authorized number of endpoints that have the Cybereason Sensor installed on them. The following services are included in the respective MDR Package:

• Continuous Real-Time Malop Monitoring and Triage
• Notification Email Alerts
• Proactive tuning and configurations
• Detailed Response Recommendations
• Malop Analysis and Investigation
• Threat findings and state-of-service report
• Phone Notifications for Critical Malops

All MDR Services will be provided in accordance with the Cybereason MDR: GSOC MDR Service Definition (“Service Definition”) which includes further detail and is provided by Cybereason upon request. Cybereason reserves the right to update the contents of the Service Definition at any time. All Customers who subscribe to notifications will be informed of material changes with advance notice. For the avoidance of doubt, authorization and direction from Customer for active remediation or any security service under the MDR Services shall be obtained in writing and in accordance with the applicable notification provisions of the Agreement, or as otherwise agreed to by the parties in writing.

Onboarding: Customer will be onboarded into MDR Essentials by Cybereason, and once onboarding has been completed, an automated email will be sent to Customer by Cybereason confirming completion of onboarding and commencement of Monitoring phase as defined this Service Description and the Service Definition.

Monitoring

Cybereason shall monitor and triage malops by leveraging its Software Platform and provide remediation recommendations.

Tasks in this stage (“Monitoring”) will include:

• Triage initial findings and expand investigation scope from malops generated by the Software Platform based on any confirmed suspicious indicators, behaviors or attack patterns within 24 hours from Malop ingestion.
• Recommendation regarding what action, if any, should be taken by Customer designed to eliminate security threats from malware detected by the Software Platform (“Cybereason-classified Known Malware”).
• Notification of Customer regarding critical findings, as applicable.

Monthly Reports

Each MDR customer will receive a standard monthly report. This report is aimed at providing an overview of the Customer’s environment and Malop activity that was seen within the previous calendar month. Cybereason reserves the right to update the contents of the Monthly Reports to provide enhanced metrics for reporting.

2. Scope Changes.Any changes to the nature or scope of the MDR Service being provided which is not expressly included herein may impact the scheduled timeline, fees charged or deliverables. Any other oral instructions shall be reduced to writing and confirmed by the parties. Depending on the scope of such changes, Cybereason may require that a separate Statement of Work, which shall detail the work to be performed including any changes, the impact of the proposed change on the charges and schedule (if any), and other relevant terms, be mutually agreed to in a signed writing.

For avoidance of doubt, the Cybereason MDR Service is bound to the activities of triage, investigation and analysis of a malop within the Cybereason Software Platform and, as such, is not within the scope of Incident Response services, such as, but not limited to, determining initial infection vector, professional services consulting, crisis management, digital forensics, advanced analysis, malware analysis, external log analysis, threat intelligence research, vulnerability research, root cause analysis and guided disaster recovery. Incident Response services will require a separate Professional Services Statement of Work as detailed above.

3. Other Terms. In the event that the customer is unable or unwilling to provide accurate and current contact information, Cybereason will not be held liable for any delays in establishing communication. All services related to the Packages will be performed in a professional and workmanlike manner. Customer understands that the Packages and all related services are dependent on Customer’s cooperation and obligations, and that Cybereason does not guarantee that it will identify, remediate or prevent all threats or Incidents. Further, for the avoidance of doubt Cybereason is not liable for any actions taken at the direction of Customer hereunder.