Leaving Swimlane (Turbine)

Swimlane exports as a .ssp solution package that carries workflow, integrations and assets but not history, records or secrets, and only system administrators can run the export. Seven of 70 matrix cells carry a path, all into D3 Security, which names Swimlane as a source. Torq, Tines and the Microsoft and Google platforms have none.

What moves

• Enrichment lookups, phishing triage, endpoint containment and identity actions: moves with tooling into D3 Security on its marketing page (vendor claim). Rebuild from scratch into every other target, Mate Security included.
• Ticketing and case sync: moves with tooling into D3 only. Rebuild from scratch into Mate and the rest.
• Custom scripted logic: moves with rework into D3. D3 says custom code is flagged for human review.
• Scheduled or batch jobs: moves with rework into D3, because D3 does not mention schedules. Rebuild from scratch into the rest.
• Torq, Tines, Google SecOps SOAR, Microsoft Sentinel, XSOAR, Splunk SOAR and agentic platforms in general: rebuild from scratch for all seven types, with no documented path on 2026-11-03.

What breaks

• What the package leaves out. The .ssp excludes application history, records, key-store secrets and secure asset values, so credentials must be re-entered in the target.
• Evidence quality. The Turbine export page, read on 2026-11-04, lists playbooks, including parent and nested playbooks, in the package. The 10x guide does not use the word playbooks.
• Who can export. Only system administrators can export or import, so schedule the work with the person who holds that role.
• Git. Turbine syncs the library to GitHub or GitLab with no branching, all commits merge to main, and edits must be made inside Turbine, so the repository is a backup and not a source of truth.
• Connectors. Custom connectors are built with the Turbine SDK and travel inside .ssp packages, so a target needs an equivalent connector written again.
• Hero AI. Agents and the Playbook Generator are Swimlane features, and no page documents an export for them.

Where to go from Swimlane (Turbine)

• D3 Security. D3 Security names Swimlane among six sources and says converted playbooks arrive in Deterministic mode with a parity report and a rollback path. All vendor claims. D3 Security v Swimlane (Turbine)
• Mate Security. Mate says it translates SOAR playbooks into Gamebooks and names no source, so Swimlane is covered only by that general claim. Ask which Swimlane content it reads. Mate Security v Swimlane (Turbine)
• Torq. Torq has no documented Swimlane importer and advises redesign over lift and shift. Its YAML workflow is easy to review, which helps a rebuild. Swimlane (Turbine) v Torq
• Tines. Tines has no documented importer and documents story export as JSON. It publishes a free edition for a proof of concept. Swimlane (Turbine) v Tines

The documented paths, with their sources

• Swimlane 10x guide, Export Swimlane solution packages: a .ssp export of applications and applets, admin only, with secrets excluded. Does not cover export to any other vendor format. docs.swimlane.com, read 2026-11-03
• D3 Playbook Migration names Swimlane among six sources with published porting coverage, custom code flagged for people and no percentage guaranteed. Does not cover leaving D3. D3 sells the target. d3security.com, read 2026-11-03
• Swimlane knowledge center lists Turbine 26.5.0 with Hero AI and an MCP server as current, a vendor statement useful for dating the version you export from. docs.swimlane.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• Export a package from a non-production instance first and read what it contains and leaves out.
• List secrets and asset values you will have to re-enter by hand.
• Identify who holds the system administrator role, since only that role can export.
• Mark the playbooks that call Python or custom connectors, and plan them as rebuilds.
• Ask the candidate in writing whether it reads .ssp packages and which workflow types it converts.
• Record your Turbine version before you export, so a later import is compared like for like.
• Run the candidate in parallel on one alert category, and keep Turbine live until the parity result is signed.