Behavioral Signals carries the Interset UEBA lineage. Interset built one of the foundational user and entity behavioral analytics products before Micro Focus acquired it in 2019; OpenText now ships the engine as Behavioral Signals inside the Cybersecurity SecOps line. The product baselines normal user and entity behavior, scores deviations, and surfaces patterns consistent with insider threat, account compromise, anomalous data access, and lateral movement.
UEBA baselines are the load-bearing capability. The product builds behavioral baselines per user and per entity (machine accounts, service accounts, devices) over a learning period, then scores live activity against the baseline. Deviations get flagged with risk scores; the SOC investigates the high-scoring users and entities. Programs that adopt UEBA without a learning period or with too-aggressive thresholds generate noise that the SOC ignores; programs with disciplined baselining catch real insider threat and account compromise.
Its scores are built for the rest of OpenText SecOps. Threat Detection and Response (SaaS SIEM) receives behavioral scoring as does Enterprise Security Manager (on-prem SIEM), for SOC investigation, and the baselines draw on Network Detection and Response and identity systems. On its own, Behavioral Signals delivers UEBA scoring, and connected to those products it becomes part of everyday SOC investigation.
Poor identity hygiene undermines UEBA, because behavioral baselines inherit every flaw in the identity store. Programs with stale provisioning, shared service accounts, and unmanaged contractor access generate UEBA baselines that look chaotic regardless of actual threat. The right pattern is to fix identity hygiene first (NetIQ Identity Manager, Identity Governance, Privileged Access Manager) and then layer UEBA on top. Merito's engagement scopes both sides honestly.
Ideal use cases
- Insider-threat detection for regulated and high-sensitivity environments
- Account compromise detection through behavioral baselining
- Anomalous data access scoring on regulated stores
- UEBA signal correlated into TDR or Enterprise Security Manager SOC operations
- Identity-aware behavioral analytics integrated with NetIQ identity infrastructure