Leaving Splunk SOAR (Cisco)
Splunk SOAR has the most documented-path cells of the seven sources, 29 of 70, and every one is a vendor statement. Swimlane, D3 Security and BlinkOps name it as a source, Tines has a library story for case records, and Microsoft publishes a dated guide to Sentinel. Splunk's own documented path goes only from on-prem to Cloud.
The corner's notes. Everything on this page is a documentation finding read on 2026-11-03. None of it is a test of a conversion.
What moves
- Enrichment lookups: moves with tooling into Swimlane, D3 Security and BlinkOps on their marketing pages (vendor claims). Moves with rework into Microsoft Sentinel, on Microsoft's Splunk SOAR guide (updated 2026-08-12, read 2026-11-04). Rebuild from scratch into Torq, Tines, XSOAR, Google SecOps, Mate Security and agentic platforms in general.
- Phishing triage, endpoint containment and identity actions: the same verdicts as enrichment.
- Ticketing and case sync: moves with tooling into Swimlane, D3 and BlinkOps. Into Tines it is moves with rework, because a library story moves case records and not logic. Into Microsoft Sentinel it is moves with rework, because the guide maps containers and cases to incidents and does not move case records. Into Mate it is rebuild from scratch.
- Custom scripted logic: moves with rework into Swimlane, D3, BlinkOps and Microsoft Sentinel, where the guide maps Code blocks to the Azure Function connector. Splunk custom functions are Python, and the destination pages say custom code is handled by people.
- Scheduled or batch jobs: moves with rework into Swimlane, D3, BlinkOps and Microsoft Sentinel, because none of their pages mention schedules. Rebuild from scratch into the rest.
- The artefact is Python generated by the visual editor. A playbook downloads as JSON and imports as a .tgz archive, into the same or a higher Splunk SOAR version only.
What breaks
- Python. On-prem to Cloud starts with converting playbooks and custom functions to Python 3, and standalone pip installs must move into application wheels modules. Python 3.9 support ends with on-prem 8.7.0 of 2026-09-02.
- Version lock. Playbooks created in 6.4.0 and later are not backward compatible, and an import must match the editor type, so a classic playbook does not import as a modern one.
- The classic editor. Classic playbooks still run but must be converted to modern mode to edit visually, which is a task before any move.
- Apps. BlinkOps says its tooling maps SplunkBase apps. No technical page backs it, so list the apps you use and ask for each by name.
- Approvals. Microsoft maps Splunk prompts to a Send approval email action in Logic Apps, so approval behaviour changes shape even where the logic moves.
- Licence. A SOAR subscription is required in addition to Enterprise Security, so retiring SOAR changes the ES bill and the architecture.
Where to go from Splunk SOAR (Cisco)
- D3 Security. D3 names Splunk SOAR among six sources with a parity report and a rollback path, all vendor claims, and has a Splunk SOAR to Morpheus guide that sorts playbooks into keep, translate and retire. D3 Security v Splunk SOAR (Cisco)
- Swimlane (Turbine). Swimlane names Splunk SOAR on its migration page with an up to 90 percent claim and no technical page. It publishes no price or deployment model. Splunk SOAR (Cisco) v Swimlane (Turbine)
- BlinkOps. BlinkOps publishes a page for leaving Splunk SOAR with a four-week plan, and says it maps playbooks, custom functions and SplunkBase apps. No technical page backs it. BlinkOps v Splunk SOAR (Cisco)
- Tines. Tines has a library story that moves Splunk SOAR case records with annotations and attachments into Tines cases. Move case history with it, and rebuild the playbook logic. Splunk SOAR (Cisco) v Tines
- Microsoft Sentinel. Microsoft publishes a concept map from Splunk SOAR to automation rules and Logic Apps, updated on 2026-08-12. It is a map and not a converter, and it suits Microsoft shops. Microsoft Sentinel v Splunk SOAR (Cisco)
The documented paths, with their sources
- Migrate Splunk SOAR (On-premises) playbooks and custom functions to Splunk SOAR (Cloud): convert to Python 3, optionally set up a Git-compatible repository, test in Cloud and move pip installs into application wheels modules. On-prem to Cloud only, on a preview mirror of the docs site. help.splunk.com, read 2026-11-03
- Export and import playbooks in Splunk SOAR (Cloud): JSON export, .tgz import, same or higher version, same editor type. Does not cover roles, file contents or other vendors. help.splunk.com, read 2026-11-03
- D3 guide from Splunk SOAR to Morpheus: sorts playbooks into keep, translate and retire, and says industry migrations often run 6 to 12 months. No importer details in the page text. D3 sells the target. d3security.com, read 2026-11-03
- BlinkOps page on migrating from Splunk SOAR: a four-week plan and a claim that import tooling maps playbooks, custom functions and SplunkBase apps. Gives no price, services or mapping accuracy. Blink sells the target. go.blinkops.com, read 2026-11-03
- Tines library story Export Splunk SOAR cases to Tines: moves case records with annotations and attachments. Does not cover playbook logic. Tines sells the target. tines.com, read 2026-11-03
- Microsoft concept map from Splunk SOAR and QRadar SOAR to Sentinel automation rules and Logic Apps, updated 2026-08-12. The page names no converter or importer tool. learn.microsoft.com, read 2026-11-03
A parallel run you can audit
Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.
- Convert classic playbooks to modern mode now, whatever you decide, so you can read what you have.
- List custom functions and the pip packages they import, and decide which become rebuilds.
- List the SplunkBase apps in use, and ask each candidate for a named answer on each one.
- Split cases from logic: move case history with a case export, and plan logic as a rebuild.
- Ask Splunk in writing what the SOAR subscription costs if you keep Enterprise Security and drop SOAR.
- Check your Python version against 8.7.0, which drops 3.9, before you plan the window.
- Run the candidate in parallel on one alert category and keep Splunk SOAR for the rest until the parity report passes.
The portability row for Splunk SOAR (Cisco)
Source format: JSON playbook export and .tgz import (help.splunk.com, read 2026-11-03). 29 of 70 cells have a documented path. Each glyph is one playbook type, left to right: Enrichment lookups, Phishing triage, Endpoint containment, Identity actions, Ticketing and case sync, Custom scripted logic, Scheduled or batch jobs.
- moves with tooling
- moves with rework
- rebuild from scratch
- not applicable
| Target | Enrichment lookups | Phishing triage | Endpoint containment | Identity actions | Ticketing and case sync | Custom scripted logic | Scheduled or batch jobs |
|---|---|---|---|---|---|---|---|
| Palo Alto Cortex XSOAR | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild |
| Swimlane (Turbine) | Tooling | Tooling | Tooling | Tooling | Tooling | Rework | Rework |
| Torq | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild |
| Tines | Rebuild | Rebuild | Rebuild | Rebuild | Rework | Rebuild | Rebuild |
| D3 Security | Tooling | Tooling | Tooling | Tooling | Tooling | Rework | Rework |
| Google Security Operations | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild |
| Microsoft Sentinel | Rework | Rework | Rework | Rework | Rework | Rework | Rework |
| BlinkOps | Tooling | Tooling | Tooling | Tooling | Tooling | Rework | Rework |
| Mate Security | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild |
| Agentic platforms in general | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild | Rebuild |
The documented paths, with their sources
| Target | Playbook type | Verdict | Reason and source |
|---|---|---|---|
| Swimlane (Turbine) | Enrichment lookups | moves with tooling | Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Phishing triage | moves with tooling | Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Endpoint containment | moves with tooling | Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Identity actions | moves with tooling | Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Ticketing and case sync | moves with tooling | Swimlane names this source and says up to 90 percent of workflows migrate automatically, without saying which workflow types (vendor claim, marketing page, no technical documentation read). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Custom scripted logic | moves with rework | Swimlane says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim). swimlane.com, read 2026-11-03 (vendor claim) |
| Swimlane (Turbine) | Scheduled or batch jobs | moves with rework | Swimlane's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim). swimlane.com, read 2026-11-03 (vendor claim) |
| Tines | Ticketing and case sync | moves with rework | A Tines library story moves Splunk SOAR case records into Tines cases, which is case data and not playbook logic. tines.com, read 2026-11-03 |
| D3 Security | Enrichment lookups | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Phishing triage | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Endpoint containment | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Identity actions | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Ticketing and case sync | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Custom scripted logic | moves with rework | D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim). d3security.com, read 2026-11-03 (vendor claim) |
| D3 Security | Scheduled or batch jobs | moves with rework | D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim). d3security.com, read 2026-11-03 (vendor claim) |
| Microsoft Sentinel | Enrichment lookups | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk SOAR playbooks, actions and connectors to Azure Logic Apps playbooks and connectors. It names no converter, so each lookup is rebuilt in the Logic App designer or taken from a Sentinel template. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Phishing triage | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk playbook steps to Logic Apps (action blocks to actions, decision to conditional control, prompt to a Send approval email step). It names no converter, so the triage flow is redone step by step. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Endpoint containment | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk action blocks to Logic Apps actions and advises human confirmation before high-impact actions. It names no converter, so each containment action is rebuilt against a connector. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Identity actions | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk action blocks to Logic Apps actions and connectors and advises human confirmation before high-impact actions. It names no converter, so identity actions are rebuilt against connectors. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Ticketing and case sync | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk containers to incidents tagged with custom details and Splunk cases to Sentinel incident grouping. It documents a concept mapping, not a transfer of case records, so ticket sync is redone. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Custom scripted logic | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps Splunk Code blocks to the Azure Function connector and says custom playbooks may need to be built from scratch or from templates. It names no converter, so custom logic is rewritten. learn.microsoft.com, read 2026-11-04 |
| Microsoft Sentinel | Scheduled or batch jobs | moves with rework | Microsoft's guide, updated 2026-08-12 and read 2026-11-04, maps the Splunk playbook editor and triggers to the Logic App designer and triggers but does not mention scheduled or batch jobs, so schedules are redone by hand. learn.microsoft.com, read 2026-11-04 |
| BlinkOps | Enrichment lookups | moves with tooling | Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Phishing triage | moves with tooling | Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Endpoint containment | moves with tooling | Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Identity actions | moves with tooling | Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Ticketing and case sync | moves with tooling | Blink says its import tooling maps Splunk SOAR playbooks, custom functions and SplunkBase apps, on a four-week plan (vendor claim, marketing page, no technical documentation read). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Custom scripted logic | moves with rework | Blink says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim). go.blinkops.com, read 2026-11-03 (vendor claim) |
| BlinkOps | Scheduled or batch jobs | moves with rework | Blink's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim). go.blinkops.com, read 2026-11-03 (vendor claim) |
What Splunk SOAR (Cisco) documents about its own formats
- Playbooks are Python code generated by the Visual Playbook Editor; the Python linter in the editor warns about changes between Python 3.9 (currently supported) and 3.13 (supported soon). help.splunk.com, read 2026-11-03
- The classic visual editor was removed in 6.4.0 (released 2025-02-25); existing classic playbooks still run but must be converted to modern mode to edit visually. Playbooks created in 6.4.0 and later are not backward compatible with earlier versions. help.splunk.com, read 2026-11-03
- A playbook is downloaded as a JSON file; it must have been saved at least once. Export takes the latest saved version. help.splunk.com, read 2026-11-03
- Import takes a .tgz playbook archive; the imported playbook is a new playbook, a source control repository must be selected, and Force Update replaces a same-name playbook. Import works into the same or higher Splunk SOAR version and the same editor type. The page does not explain how the JSON export relates to the .tgz archive. help.splunk.com, read 2026-11-03
- On-premises to Cloud: convert playbooks and custom functions to Python 3 first, optionally set up a Git-compatible HTTP or HTTPS repository, then test in Cloud. Standalone `phenv python pip install` imports must move into application wheels modules. help.splunk.com, read 2026-11-03
Gaps: docs.splunk.com pages returned HTTP 403 to plain fetch on 2026-11-03; help.splunk.com mirrors were read instead. Role or permission needed to import/export is not stated on the page read.
What vendors publish about leaving Splunk SOAR (Cisco)
Each item names who wrote it and what commercial interest they have in the target.
- Migrate Splunk SOAR (On-premises) playbooks and custom functions to Splunk SOAR (Cloud). On-prem to Cloud only: convert to Python 3 first, optional Git-compatible repo, test in Cloud, move pip installs into application wheels modules. Does not cover: Moving to any other vendor. Preview mirror of the docs site. help.splunk.com, read 2026-11-03
- Export and import playbooks in Splunk SOAR (Cloud). JSON export, .tgz import, same or higher version, same editor type. Does not cover: Roles, contents of the file, other vendors. help.splunk.com, read 2026-11-03
- From Splunk SOAR to Morpheus migration guide (D3). Keep, translate, retire triage of playbooks; lifecycle claims; industry migrations "often run 6 to 12 months". Does not cover: No importer details in the page text read. d3security.com, read 2026-11-03 (vendor claim) (D3 sells the target)
- Migrate from Splunk SOAR to Blink. Four-week plan, claims import tooling maps playbooks, custom functions and SplunkBase apps. Does not cover: Pricing, services, accuracy of mapping. go.blinkops.com, read 2026-11-03 (vendor claim) (Blink sells the target)
- Tines library story: Export Splunk SOAR cases to Tines. Moves case records from Splunk SOAR into Tines cases with annotations and attachments. Does not cover: Playbook logic. tines.com, read 2026-11-03 (Tines sells the target)
- Swimlane SOAR migration. Names Splunk SOAR as a source; up to 90 percent claim. Does not cover: Tooling detail. swimlane.com, read 2026-11-03 (vendor claim) (Swimlane sells the target)
Lifecycle notices that affect timing
- Splunk product page footer reads "2026 Cisco Systems" and logo "Splunk by Cisco". Completion date 2024-03-18 is stated by D3 and not read on a Cisco page. splunk.com, read 2026-11-03
- Splunk page: "Splunk SOAR is now a native capability within Splunk Enterprise Security" with "(Splunk SOAR subscription required)"; claims 300+ tools and 2,800+ actions. splunk.com, read 2026-11-03
- No Cisco or Splunk end-of-sale or end-of-life notice for Splunk SOAR was found. D3 says no formal end-of-life has been announced; Blink says "roadmap unclear for standalone product" without a source. Both are competitor statements. d3security.com, read 2026-11-03
- 6.4.0 (2025-02-25) removed the classic visual editor, kept Python 3.9 as supported with 3.13 coming. D3 claims 3.9 support ends with a September 2026 release; not confirmed on a Splunk page. help.splunk.com, read 2026-11-03
Back to Splunk SOAR (Cisco), its alternatives, or the full matrix.