OpenText Threat Intelligence

OpenText Threat Intelligence is the curated IOC and threat-intelligence product inside the OpenText SecOps line. It delivers continuously-updated indicators of compromise (malicious domains, IPs, hashes, URLs), brand-and-attack-surface monitoring, and threat-actor reporting. Where Core Adversary Signals covers TTP and tradecraft depth, Threat Intelligence covers IOC and infrastructure depth. Programs running both get adversary-aware SOC operations across techniques and indicators.

IOC enrichment is the load-bearing capability for SIEM-shaped SOC operations. SIEM detections that trigger on raw events generate noise; SIEM detections enriched with threat-intel context (this IP is on a malicious-actor list, this domain is sinkhole infrastructure, this hash matches a known malware family) get prioritized triage. OpenText Threat Intelligence feeds are designed to integrate with Core Threat Detection and Response and Enterprise Security Manager so the enrichment is native rather than bolted on.

Brand-and-attack-surface monitoring is the secondary capability that programs sometimes underuse. The product monitors brand impersonation (typosquatted domains, fraudulent social media presence), attack-surface exposure (exposed cloud assets, leaked credentials, dark-web mentions), and supply-chain risk indicators. Programs subject to brand-impersonation attacks or sensitive about supply-chain exposure get an early-warning capability that pure IOC feeds do not provide.

What breaks Threat Intelligence adoption is feed overload. Programs that subscribe to OpenText Threat Intelligence alongside three or four specialist feeds (Recorded Future, Mandiant, sector ISAC, internal CTI) and route everything into the SIEM end up with so much enrichment context that triage becomes impossible. The right shape is feed prioritization and de-duplication: which feeds are authoritative for which IOC types, how to handle conflicts, and what the noise floor is. Merito's engagement designs the feed-prioritization policy so the SOC gets enrichment without overload.

Merito has audited SOCs paying for four threat-intel subscriptions and getting less value than programs running one well-prioritized feed integration. Feed overload is the dominant failure mode in CTI programs: too many IOC sources flooding the SIEM, conflicting confidence scores, no de-duplication discipline, and a triage queue that ignores all of it. OpenText Threat Intelligence is the right answer when programs want a curated feed integrated natively with their SecOps line; programs that already run mature Recorded Future or Mandiant Advantage subscriptions usually do not need a duplicate.

Merito recommends OpenText Threat Intelligence specifically for programs running OpenText SecOps line, when sector or regional intelligence is real, and when brand-and-attack-surface monitoring is in scope. For programs picking specialist threat-intelligence breadth, Recorded Future is the breadth leader and Mandiant Advantage is investigation-led. Merito surfaces those alternatives honestly during scoping.

The pairing with Core Adversary Signals is the load-bearing move on adversary-aware SOC operations. Threat Intelligence covers IOC depth (specific known-bad infrastructure); Core Adversary Signals covers TTP depth (how adversaries operate). Programs running both get IOC plus TTP coverage; programs running only one get half the picture.