OpenText Threat Intelligence is OpenText's curated IOC and threat-intelligence service for the SOC. It delivers continuously-updated indicators of compromise (malicious domains, IPs, hashes, URLs), brand-and-attack-surface monitoring, and threat-actor reporting. Where Adversary Signals covers TTP and tradecraft depth, Threat Intelligence covers IOC and infrastructure depth. Programs running both get adversary-aware SOC operations across techniques and indicators.
For a SIEM-centered SOC, the core value is IOC enrichment. SIEM detections that trigger on raw events generate noise, while detections enriched with threat-intel context (this IP is on a malicious-actor list, this domain is sinkhole infrastructure, this hash matches a known malware family) get prioritized triage. OpenText Threat Intelligence feeds are designed to integrate with Threat Detection and Response and Enterprise Security Manager so the enrichment is native rather than bolted on.
Brand-and-attack-surface monitoring is the secondary capability that programs sometimes underuse. The product monitors brand impersonation (typosquatted domains, fraudulent social media presence), attack-surface exposure (exposed cloud assets, leaked credentials, dark-web mentions), and supply-chain risk indicators. Programs subject to brand-impersonation attacks or sensitive about supply-chain exposure get an early-warning capability that pure IOC feeds do not provide.
Feed overload is the risk to watch. Programs that subscribe to OpenText Threat Intelligence alongside three or four specialist feeds (Recorded Future, Mandiant, sector ISAC, internal CTI) and route everything into the SIEM end up with so much enrichment context that triage becomes impossible. The right shape is feed prioritization and de-duplication, which settles which feeds are authoritative for which IOC types, how conflicts are handled and where the noise floor sits. Merito's engagement designs the feed-prioritization policy so the SOC gets enrichment without overload.
Ideal use cases
- Curated IOC feeds for SIEM and NDR enrichment
- Threat-actor reporting for IR and CTI workflows
- Brand impersonation and attack-surface monitoring
- Sector-specific threat intelligence for regulated industries
- One threat-intelligence subscription shared by OpenText SIEM, NDR and log analytics