Leaving Google Security Operations

Google SecOps SOAR exports playbooks and blocks as ZIP files meant for staging to production moves, and no importer from another vendor was found. Seven of 70 matrix cells carry a path, all into D3 Security, which names Siemplify, now Google SecOps SOAR, as a source. Case playbooks add an audit gap.

What moves

• Enrichment lookups, phishing triage, endpoint containment and identity actions: moves with tooling into D3 Security, which names Siemplify as a source (vendor claim). Rebuild from scratch elsewhere, Mate Security included.
• Ticketing and case sync: moves with tooling into D3 only.
• Custom scripted logic: moves with rework into D3.
• Scheduled or batch jobs: moves with rework into D3, and rebuild from scratch into the rest.
• Torq, Tines, XSOAR, Splunk SOAR, Sentinel, BlinkOps and agentic platforms in general: rebuild from scratch for all seven types, with no documented path on 2026-11-03.

What breaks

• ZIP only. The system accepts only ZIP files for import, and the format is meant for staging to production, so no other platform documents reading it.
• Case playbooks. Case playbook executions are excluded from Legacy Monitoring dashboards and from SOAR data exports, so run history for them does not leave.
• Naming. Playbook names must be unique across alert and case playbooks, and only one playbook attaches automatically to an alert, by priority.
• Integrations. Custom integrations are private to the instance, and update rollback needs a snapshot and is unsupported for Python 2.7 and 3.7 integrations.
• Disabled on arrival. A community repository says imported playbooks arrive disabled in an Imported Playbooks folder, so re-enable deliberately.
• Naming history. The product was Siemplify, then Chronicle SOAR, and Google staff dated the Google Security Operations rebrand to 2024-04-25, so older documents use older names.

Where to go from Google Security Operations

• D3 Security. D3 Security names Siemplify among six sources and says converted playbooks arrive in Deterministic mode. Vendor claims, with no third-party check. D3 Security v Google Security Operations
• Torq. Torq documents a YAML workflow and names no Google SecOps importer. Plan a rebuild. Google Security Operations v Torq
• Tines. Tines documents story export and import and publishes a free edition for a proof of concept. No importer is documented. Google Security Operations v Tines
• Mate Security. Mate claims translation of SOAR playbooks into Gamebooks without naming a source, so ask whether it reads the ZIP. Google Security Operations v Mate Security

The documented paths, with their sources

• Playbooks screen docs: Export and Import move playbooks and blocks between staging and production, and the system accepts only ZIP files. Does not cover leaving Google SecOps. docs.cloud.google.com, read 2026-11-03
• D3 Playbook Migration names Siemplify, now Google SecOps SOAR, among six sources. It gives no detail on the ZIP file. D3 sells the target. d3security.com, read 2026-11-03
• Google staff post of 2024-04-25: Chronicle Security Operations has been rebranded to Google Security Operations with no functional change. The post does not mention Chronicle SOAR. security.googlecloudcommunity.com, read 2026-11-03
• Python version upgrade docs cover certified and custom integrations, connectors and remote agents, with integration rollback to a previous installed version. Read through a search summary. docs.cloud.google.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• Export a ZIP from staging and open it, so you know what a package holds.
• List case playbooks separately, since their run history is excluded from exports.
• Record which integrations are custom and which are Content Hub, and their Python versions.
• Ask the candidate in writing whether it reads Google SecOps ZIP files.
• Check which Gemini-authored playbooks exist, and review their conditions by hand.
• Keep the instance live in parallel until the parity report passes.
• Archive playbook statistics before you retire the instance.