Features

Long reads for people who run a SOAR or are about to leave one. Each has sourced facts with read dates and ends in a checklist you can run against your own estate.

1. 1 A parallel run you can audit: parity reports, rollback and exit criteria How to run an old SOAR beside its replacement, prove parity on replayed incidents, keep a rollback and set exit criteria. Vendor claims stay labelled. 4 November 2026.
2. 2 Approvals: per action, per playbook or per product Where each platform puts the human: Mate autonomy modes, Torq oversight, Sentinel author-built steps, Cyware mobile approval. Sources read 2026-11-03. 4 November 2026.
3. 3 Export formats compared: Torq YAML, Tines story files, ARM templates Which platforms export playbooks as YAML, JSON, ZIP, XML or ARM, what each file leaves out and which import a rival's format. Sources read 2026-11-03. 4 November 2026.
4. 4 How to read a vendor's integration count Integration counts mix packs, apps, actions and templates. Compare 900+, 400+, 800+ and 2,800+ by unit, date and custom path. Sources read 2026-11-03. 4 November 2026.
5. 5 Leaving Splunk SOAR as it becomes part of Enterprise Security What the Enterprise Security packaging, the Python 3.9 drop and the Cisco ownership mean for a Splunk SOAR exit, with dated facts, read on 2026-11-03. 4 November 2026.
6. 6 Running a playbook and an agent side by side: ownership per alert category How to give each alert category to a playbook or an agent, using what Swimlane, D3, Torq, Mate and Splunk document about autonomy. Read on 2026-11-03. 4 November 2026.
7. 7 Sentinel playbooks after the Defender portal move After 2027-03-31 Sentinel runs only in the Defender portal. What changes for automation rules and Logic Apps playbooks. Dated sources read 2026-11-03. 4 November 2026.
8. 8 What actually moves when you leave Cortex XSOAR A SOC lead's inventory of what leaves Cortex XSOAR intact, what needs rewriting, and which lifecycle dates set your deadline. Sources read 2026-11-03. 4 November 2026.