Microsoft updates its Splunk SOAR to Sentinel migration guide

Microsoft updated its guide to migrating Splunk SOAR automation to Sentinel on 2026-08-12. It maps Splunk concepts to Sentinel automation rules and Azure Logic Apps playbooks, names Azure Functions for code, and maps Splunk prompts to a Send approval email action. It also says high-impact automations should have human input.

The page is a concept map. It says most Sentinel playbooks are available as templates and that in some cases you create playbooks from scratch or from templates in the Logic App designer. It names no converter or importer tool. The portability matrix scores the seven Splunk SOAR to Sentinel cells as moves with rework on this guide (read 2026-11-04), the one dated vendor guide for a documented path in the matrix.

Source: learn.microsoft.com, read 2026-11-04.

What it changes for a buyer

A Splunk SOAR team that already runs Sentinel gets a free checklist of equivalents. Budget the work as a rework of each playbook, and use the map to size it.

Other dispatches

• Mate Labs publishes the Blue City benchmark, without Mate in it, 3 November 2026
• XSOAR 8.11 reaches end-of-life on 2026-11-13, 3 November 2026
• Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed, 3 November 2026
• ThreatConnect's domain now redirects to Dataminr, 3 November 2026
• Google updates its SecOps playbooks screen documentation, 28 October 2026
• Torq says IDC named it a Leader in its AI SOC MarketScape, 20 October 2026
• Mate publishes CPR, its gate for autonomous actions, 18 October 2026
• Google SecOps curated rules move to the GTI_IOC feed, 12 October 2026
• Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent, 2 September 2026
• Mate Gamebooks reach general availability, 26 August 2026
• ServiceNow press report puts a Tier 2 SOC AI Specialist in December, 5 August 2026

More notes in Dispatches. To see the platforms side by side, start from the card.