Leaving D3 Security

D3 Security exports and imports playbooks as encrypted XML, YAML or JSON between its own systems, and documents no export to another vendor's format. Seven of 70 matrix cells carry a path, all into Swimlane, which names D3 as a source. Ask for an export of what you hold before you sign.

What moves

• Enrichment lookups, phishing triage, endpoint containment and identity actions: moves with tooling into Swimlane on its marketing page (vendor claim). Rebuild from scratch elsewhere, Mate Security included.
• Ticketing and case sync: moves with tooling into Swimlane only.
• Custom scripted logic: moves with rework into Swimlane.
• Scheduled or batch jobs: moves with rework into Swimlane and rebuild from scratch into the rest.
• Torq, Tines, XSOAR, Splunk SOAR, Google SecOps, Sentinel, BlinkOps and agentic platforms in general: rebuild from scratch for all seven types, with no documented path on 2026-11-03.

What breaks

• Export stays inside D3. The 18.6 guide, read on 2026-11-04, documents export and import as encrypted XML, YAML or JSON between D3 Morpheus systems, and no export to another vendor's format.
• Autonomy modes. Morpheus has four modes, Deterministic, AI-Assisted, AI-Led and Autonomous, and the settings are D3-specific, so they do not carry across.
• Rename. The product line moved from Smart SOAR to Morpheus, and D3 says Morpheus is a new build, so check which generation your playbooks come from.
• Utility Commands. They can be Python or codeless playbooks, and the Python part is a rebuild anywhere.
• Vendor claims. Self-healing integrations and the 98 percent triage accuracy figure are D3 claims, and no equivalent exists to carry them.
• Contract. Pricing is by daily alert volume tier, so a tier commitment may outlast the move.

Where to go from D3 Security

• Swimlane (Turbine). Swimlane names D3 on its migration page with an up to 90 percent claim. It is a vendor claim with no technical page. D3 Security v Swimlane (Turbine)
• Mate Security. Mate claims translation of SOAR playbooks into Gamebooks and names no source. D3 already offers autonomy modes, so Mate may fit teams moving further toward agent-run work. D3 Security v Mate Security
• Torq. Torq documents YAML export and case management, and names no D3 importer. D3 Security v Torq
• Tines. Tines documents story export as JSON and publishes a free edition, with no importer for D3. D3 Security v Tines

The documented paths, with their sources

• D3 18.6 guide: a saved playbook version exports as encrypted XML (the default), YAML or JSON, and Import Playbook takes XML, YAML or JSON. It does not describe export to another vendor's format. docs.d3security.com, read 2026-11-04
• D3 Playbook Migration covers inbound migrations from six platforms. It does not cover leaving D3. d3security.com, read 2026-11-03
• Swimlane SOAR migration names D3 among the sources it takes, with an up to 90 percent claim and no tooling detail. Swimlane sells the target. swimlane.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• Ask D3 in writing for an export of your playbooks and the format it uses.
• Record which of your playbooks run in each autonomy mode.
• Separate Python Utility Commands from codeless playbooks.
• Check your contract for the alert tier commitment and its end date.
• Ask the candidate which D3 content it reads, and what it flags for review.
• Run the candidate in parallel on one alert category using replayed incidents.
• Keep a rollback path open until the retirement is signed.