{
 "name": "After SOAR playbook portability matrix",
 "read_dates": {
  "2026-11-03": 588,
  "2026-11-04": 49
 },
 "license": "CC BY 4.0",
 "verdicts": [
  "moves with tooling",
  "moves with rework",
  "rebuild from scratch",
  "not applicable"
 ],
 "playbook_types": {
  "enrichment": "Enrichment lookups",
  "phishing": "Phishing triage",
  "containment": "Endpoint containment",
  "identity": "Identity actions",
  "ticketing": "Ticketing and case sync",
  "custom": "Custom scripted logic",
  "scheduled": "Scheduled or batch jobs"
 },
 "counts": {
  "total": 693,
  "documented_path": 64,
  "rebuild": 573,
  "not_applicable": 56,
  "by_evidence": {
   "same_platform": 56,
   "none": 528,
   "vendor_claim_importer": 56,
   "vendor_claim_unnamed_source": 45,
   "library_story": 1,
   "vendor_guide": 7
  }
 },
 "cells": [
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR is both source and target, so there is nothing to move.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR custom logic is Python or JavaScript, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR custom logic is Python or JavaScript, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR custom logic is Python or JavaScript, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR custom logic is Python or JavaScript, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "palo-alto-cortex-xsoar",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Palo Alto Cortex XSOAR exports YAML metadata plus Python or JavaScript in content packs, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://xsoar.pan.dev/docs/packs/packs-format",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR custom logic is Python 3.9 playbooks, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Splunk SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "moves with rework",
   "evidence": "library_story",
   "vendor_claim": false,
   "reason": "A Tines library story moves Splunk SOAR case records into Tines cases, which is case data and not playbook logic.",
   "source_url": "https://www.tines.com/library/stories/1231580/export-splunk-soar-cases-to-tines",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR custom logic is Python 3.9 playbooks, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk SOAR playbooks, actions and connectors to Azure Logic Apps playbooks and connectors. It names no converter, so each lookup is rebuilt in the Logic App designer or taken from a Sentinel template.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk playbook steps to Logic Apps (action blocks to actions, decision to conditional control, prompt to a Send approval email step). It names no converter, so the triage flow is redone step by step.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk action blocks to Logic Apps actions and advises human confirmation before high-impact actions. It names no converter, so each containment action is rebuilt against a connector.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk action blocks to Logic Apps actions and connectors and advises human confirmation before high-impact actions. It names no converter, so identity actions are rebuilt against connectors.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk containers to incidents tagged with custom details and Splunk cases to Sentinel incident grouping. It documents a concept mapping, not a transfer of case records, so ticket sync is redone.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk Code blocks to the Azure Function connector and says custom playbooks may need to be built from scratch or from templates. It names no converter, so custom logic is rewritten.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_guide",
   "vendor_claim": false,
   "reason": "Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps the Splunk playbook editor and triggers to the Logic App designer and triggers but does not mention scheduled or batch jobs, so schedules are redone by hand.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation",
   "read_date": "2026-11-04"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Blink's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://go.blinkops.com/migrate-from-splunk-to-blink",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "splunk-soar",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Splunk SOAR exports JSON playbook export and .tgz import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://help.splunk.com/ja-jp/splunk-soar/soar-cloud/develop-apps/build-playbooks/manage-playbooks-and-playbook-settings/export-and-import-playbooks-in-splunk-soar-cloud",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane custom logic is Turbine connectors (tsdk), but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane custom logic is Turbine connectors (tsdk), but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Swimlane is both source and target, so there is nothing to move.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane custom logic is Turbine connectors (tsdk), but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane custom logic is Turbine connectors (tsdk), but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane custom logic is Turbine connectors (tsdk), but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane documents .ssp solution packages, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "swimlane",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Swimlane exports .ssp solution packages, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.swimlane.com/user-guide-10x/export-swimlane-solution-packages",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Swimlane documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Torq is both source and target, so there is nothing to move.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but D3 Security documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq custom logic is Python script steps, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq documents workflow YAML, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "torq",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq exports workflow YAML, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://kb.torq.io/en/articles/9140014-export-and-import-workflows-in-torq",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Swimlane documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Tines is both source and target, so there is nothing to move.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but D3 Security documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines custom logic is Python Run script action, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines documents story JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "tines",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines exports story JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/docs/stories/importing-and-exporting/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security custom logic is Python utility commands, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/utility-commands",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security custom logic is Python utility commands, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/utility-commands",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "Swimlane's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://swimlane.com/soar-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "D3 Security is both source and target, so there is nothing to move.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security custom logic is Python utility commands, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/utility-commands",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security custom logic is Python utility commands, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/utility-commands",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security custom logic is Python utility commands, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/utility-commands",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "d3-security",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://docs.d3security.com/user-docs/18.6/exporting-and-importing-a-playbook-as-yaml-or-json",
   "read_date": "2026-11-04"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR custom logic is Python in the IDE, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR custom logic is Python in the IDE, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR custom logic is Python in the IDE, but Swimlane documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "moves with tooling",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "moves with rework",
   "evidence": "vendor_claim_importer",
   "vendor_claim": true,
   "reason": "D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim).",
   "source_url": "https://d3security.com/playbook-migration/",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR is both source and target, so there is nothing to move.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR custom logic is Python in the IDE, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR custom logic is Python in the IDE, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR documents playbook ZIP export and import, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "google-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Google SecOps SOAR exports playbook ZIP export and import, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but Swimlane documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but D3 Security documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "not applicable",
   "evidence": "same_platform",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation is both source and target, so there is nothing to move.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation custom logic is Logic Apps JSON definitions (no scripting language documented on the page read), but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation documents Logic Apps ARM JSON, but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "microsoft-sentinel",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Microsoft Sentinel automation exports Logic Apps ARM JSON, but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "palo-alto-cortex-xsoar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "splunk-soar",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Swimlane documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "swimlane",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Swimlane, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "torq",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03.",
   "source_url": "https://torq.io/blog/soar-migration-soc-transformation",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "tines",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03.",
   "source_url": "https://www.tines.com/blog/migrating-from-legacy-soar-tines-step-by-step-guide/",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but D3 Security documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "d3-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Google SecOps SOAR documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "google-secops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Google SecOps SOAR, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "microsoft-sentinel",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations custom logic is no scripting language named on the page read, but Blink Ops documents no importer for it, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "blink-ops",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations documents update set XML (third-party guide only), but no importer for it or migration guide was found for Blink Ops, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says it translates SOAR playbooks into Gamebooks of investigative intent but its page names no source platform or format, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers case sync, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "vendor_claim_unnamed_source",
   "vendor_claim": true,
   "reason": "Mate says \"your custom logic stays\" after translation but names no source platform, format or mechanism, so no documented path on 2026-11-03 (vendor claim, unverified).",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "mate-security",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "Mate describes Gamebooks as investigation procedures and no page covers scheduled or batch jobs, so no documented path on 2026-11-03.",
   "source_url": "https://mate.security/platform/gamebooks",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "enrichment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "phishing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "containment",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "identity",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "ticketing",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "custom",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  },
  {
   "source": "servicenow-secops",
   "target": "agentic-platforms-general",
   "playbook_type": "scheduled",
   "verdict": "rebuild from scratch",
   "evidence": "none",
   "vendor_claim": false,
   "reason": "ServiceNow Security Operations exports update set XML (third-party guide only), but no importer for it on an agentic platform other than Mate was found, so no documented path on 2026-11-03.",
   "source_url": "https://www.servicenow.com/docs/r/aWI6yzr0o7OSh9MJT0Yyxw/sn_gcspBUb7oCQcu~HnxHQ",
   "read_date": "2026-11-03"
  }
 ]
}