Threat Detection and Response is OpenText's SaaS SOC platform and carries the ArcSight cloud lineage, rebranded for the cloud-native era. Where Enterprise Security Manager (ArcSight ESM) remains the on-prem flagship for high-throughput regulated SIEM, Threat Detection and Response is the SaaS-first option for programs that have moved past on-prem SIEM constraints. The product covers detection content, investigation workflow, and response automation in one platform.
ArcSight detection content is the operational depth. ArcSight has been deployed in regulated SOC environments for two decades, and the rule library covers the threat patterns regulated programs actually face: insider threat, account compromise, lateral movement, data exfiltration, credential misuse. Programs adopting Threat Detection and Response inherit that content base rather than starting from scratch the way a fresh SIEM deployment would.
Its value grows with the other OpenText SecOps products. Threat Detection and Response correlates with Network Detection and Response (east-west traffic), Behavioral Signals (Interset UEBA), Adversary Signals (MITRE ATT&CK content), Threat Intelligence (curated IOC feeds) and Security Log Analytics (long-retention forensic store). Connected to them it runs unified SOC operations, while on its own it is a SIEM without that cross-product depth.
Threat Detection and Response is a poor fit when it is bought as a straight Splunk replacement. Splunk dominates SIEM market share for cloud-native enterprises, and programs already running mature Splunk pipelines often do not have a compelling delta to justify migration. TDR fits programs that are already on ArcSight and modernizing to SaaS, programs subject to OpenText catalog consolidation, or programs that find Splunk pricing punishing at log volume. Scoping makes that call explicitly instead of pitching TDR as a generic Splunk alternative.
Ideal use cases
- SaaS SIEM for cloud-native SOCs
- Modernizing off ArcSight ESM on-prem onto TDR SaaS
- Cross-product SOC operations across NDR, UEBA, threat intel, and long-retention logging
- Detection content inheriting from ArcSight regulated SOC depth
- Regulated SOC evidence under SOC 2, FedRAMP, HIPAA, PCI DSS