Among OpenText's SecOps products, Adversary Signals is the one that tracks adversaries. It pulls MITRE ATT&CK-aligned content (tactics, techniques, procedures, threat-actor profiles) into SOC workflows, correlates observed activity against known adversary tradecraft, and gives SOC analysts actor and TTP context on alerts. Programs running SIEM and UEBA without adversary intelligence detect anomalies, while programs adding Adversary Signals detect anomalies in the context of who is doing what.
MITRE ATT&CK alignment is the load-bearing capability. ATT&CK is the industry-standard adversary-tradecraft framework, and SOCs that map detections to ATT&CK techniques get richer triage context, gap analysis (which techniques the SOC is not catching), and threat hunting structured around adversary patterns rather than ad-hoc IOC chasing. Adversary Signals provides curated ATT&CK content with OpenText threat-research analyst perspective on top.
Its adversary content is used across OpenText's SecOps products. Threat Detection and Response (SaaS SIEM), Enterprise Security Manager (on-prem SIEM), Network Detection and Response, Behavioral Signals (UEBA) and Threat Intelligence (curated IOCs) all consume it. Connected to them, it makes SOC operations adversary-aware, and used on its own it delivers the content without that workflow integration.
The content only matters if the SOC puts it to work. Programs that subscribe to ATT&CK content, push it into the SIEM, and never use it for hunt or triage gap analysis end up paying for content that nobody references. Implementation designs the operational pattern, covering which detections map to which techniques, the gap-analysis cadence, how hunt programs use adversary content and how threat-actor profiles inform IR response. Without that, the subscription is shelfware.
Ideal use cases
- MITRE ATT&CK content integrated into SIEM and detection workflows
- Threat-actor profile context for SOC triage and IR response
- Detection-coverage gap analysis against ATT&CK techniques
- Threat hunting structured around adversary tradecraft
- Adversary-aware SOC operations alongside TDR or Enterprise Security Manager