Leaving Palo Alto Cortex XSOAR

Leaving Cortex XSOAR means rebuilding most of the work. In the portability matrix 14 of 70 target cells carry a documented path, and every one is a vendor statement: Swimlane and D3 Security name XSOAR as a source, while Mate claims translation without naming one and scores rebuild. No technical importer page exists, and Palo Alto publishes no leaving guide.

What moves

• Enrichment lookups: moves with tooling into Swimlane and D3 Security on their marketing pages (vendor claims, no technical docs). Rebuild from scratch into every other target, Mate Security included, because its page names no source or format.
• Phishing triage: the same verdicts as enrichment. Swimlane and D3 say structure, inputs, outputs, approval steps and mapped integration commands port without a person, which is a vendor claim to test.
• Endpoint containment: moves with tooling into Swimlane and D3, rebuild elsewhere. Containment depends on one EDR connector, so check that connector exists in the target before you trust the verdict.
• Identity actions: the same verdicts as containment.
• Ticketing and case sync: moves with tooling into Swimlane and D3 only. Mate gets rebuild from scratch, because its page names no source and Gamebooks are described as investigation procedures.
• Custom scripted logic: moves with rework into Swimlane and D3. XSOAR scripts are Python or JavaScript inside content packs, and both Swimlane and D3 say custom code is handled by people.
• Scheduled or batch jobs: moves with rework into Swimlane and D3, and rebuild from scratch into the rest.
• Torq, Tines, Google SecOps SOAR, Microsoft Sentinel, BlinkOps and agentic platforms in general: rebuild from scratch for all seven types, with no documented path on 2026-11-03.

What breaks

• Custom Python and JavaScript. D3 says custom code and anything without a Morpheus equivalent is flagged for human review, and Swimlane says custom code is handled by people. Both are vendor claims.
• Integration parity. The matrix does not measure whether a connector exists in the target. XSOAR claims 900+ packs on one page and 850+ on another, so count the packs you actually use.
• Pack metadata. A pack carries YAML metadata and a pack_metadata.json version. No target documents reading either, so treat a pack as source material for a rebuild.
• Export of a single XSOAR 8 playbook is not confirmed in the official docs read. A pan.dev job builds a zip bundle for another XSOAR server, which is not a move to another product.
• The clock. XSOAR 6.12 and 6.13 reached end-of-life on 2026-06-30, and XSOAR 8.11 ends on 2026-11-13. The AgentiX release names a successor and gives no migration path or XSOAR end-of-sale date.
• Conflicting promises. Swimlane says up to 90 percent of workflows migrate automatically. D3 says it guarantees no percentage. Both pages are written by a seller of the destination.

Where to go from Palo Alto Cortex XSOAR

• D3 Security. D3 publishes the only migration program that names XSOAR as one of six sources, lists what does not port and promises a parity report and a rollback path. Every part is a vendor claim, and migration scores 8.5 on that basis. D3 Security v Palo Alto Cortex XSOAR
• Swimlane (Turbine). Swimlane names Palo Alto XSOAR on its migration page and claims up to 90 percent of workflows migrate automatically. No technical page backs the figure, so ask for a named list of XSOAR playbook types it converts. Palo Alto Cortex XSOAR v Swimlane (Turbine)
• Torq. Torq documents a YAML workflow format that is easy to read and re-import, and advises redesign over lift and shift. It names no XSOAR converter, so budget for a rebuild. Palo Alto Cortex XSOAR v Torq
• Mate Security. Mate says it translates SOAR playbooks into Gamebooks and offers a free playbook migration assessment. It names no source SOAR, so ask which XSOAR content it reads. Mate Security v Palo Alto Cortex XSOAR

The documented paths, with their sources

• D3 migration guide for XSOAR: professional services translate XSOAR playbooks to Morpheus automation and frame XSIAM as a platform uplift. It does not mention the XSOAR playbook file format. D3 sells the target. d3security.com, read 2026-11-03
• D3 Playbook Migration lists XSOAR among six sources with published porting coverage, converted playbooks arriving in Deterministic mode, custom code flagged for people and no percentage guaranteed. Names no per-platform export format. D3 sells the target. d3security.com, read 2026-11-03
• Swimlane SOAR migration names Palo Alto XSOAR, claims up to 90 percent of workflows migrate automatically and says a 3-year agreement gives up to the first year free. Describes no workflow types, tooling or services. Swimlane sells the target. swimlane.com, read 2026-11-03
• Palo Alto content pack format: packs can target xsoar for versions 6 and 8, xsoar_on_prem, xsoar_saas, marketplacev2 for XSIAM and xpanse. No XSOAR to XSIAM migration steps on this page. xsoar.pan.dev, read 2026-11-03
• Palo Alto Upgrade to XSIAM tech brief pitches AI-powered migration, expert guidance and prebuilt content. It is about SIEM replacement and has no XSOAR playbook migration detail. paloaltonetworks.com, read 2026-11-03
• The Cortex AgentiX release of 2025-10-28 calls AgentiX the successor to Cortex XSOAR, available in Cortex Cloud and XSIAM with a standalone platform planned for early 2026. It gives no XSOAR end-of-sale date and no migration path. paloaltonetworks.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• List every playbook and tag it with one of the seven types: enrichment, phishing, containment, identity, ticketing, custom logic, scheduled jobs.
• Count the content packs and integrations you actually run, and check each has a connector in the target.
• Separate playbooks that call custom Python or JavaScript, since every vendor page says people handle them.
• Ask each candidate, in writing, which XSOAR playbook types it converts and what it flags for review.
• Run a proof of concept on three playbooks of different types before you sign, and read the parity result yourself.
• Pin your XSOAR version against the lifecycle page and write down its end-of-life date.
• Plan a parallel run with an exit rule: what parity you need and who signs the retirement.