Playbook portability matrix

It is the table a team needs before it signs a migration plan. Read dates: 2026-11-03 for 588 cells and 2026-11-04 for 49 cells.

The seven playbook types

Enrichment lookups, phishing triage, endpoint containment, identity actions, ticketing and case sync, custom scripted logic, and scheduled or batch jobs. They span read steps, write steps, two-way state and code, and migration pages mention or omit them most often.

The four verdicts

• Moves with tooling: a vendor states an importer or converter for this source into this target, and names the source.
• Moves with rework: a vendor page that names the source platform documents the path, cited with the date it was read, but the page says or implies that people must redo part of it.
• Rebuild from scratch: no documented path on 2026-11-03. That is a finding, not a gap in the research, except where the method page says a search was not run.
• Not applicable: source and target are the same platform.

How few cells rest on an importer

The matrix has 693 cells. Of those, 56 are same-platform pairs, which leaves 637. A documented path exists for 64 of them, and 573 are rebuild from scratch. None of the 64 rests on a technical importer document in a target's own docs.

The 64 come from three places: 56 cells from vendor marketing pages that name the source (D3 Security 28, Swimlane 21, BlinkOps 7), 7 cells from Microsoft's Splunk SOAR to Sentinel migration guide (updated 2026-08-12, read 2026-11-04), and 1 cell from a Tines library story that moves case records and not logic. By verdict, 40 are moves with tooling and 24 are moves with rework. Mate Security claims to translate SOAR playbooks but its page names no source platform or format, so its 63 cells are rebuild from scratch. Treat all 64 as claims to test.

How to read a row

Start with the source product and read left to right. A row of rebuild cells means no documented path. For any cell with a path, check the evidence label, then open the source link and read the page behind it.

What the matrix does not measure

Effort or hours, licence or services cost, data fidelity after conversion, whether a connector exists in the target, the quality of any vendor tool, and runtime behaviour. A moves-with-tooling cell does not mean it works. A rebuild cell does not mean it is hard.

Limits of this edition

Searches for migrations into Google SecOps SOAR, Sentinel, XSOAR and Splunk SOAR, and for partner migration pages, were not completed, so those columns read rebuild and should be re-searched, except the Splunk SOAR to Sentinel cells, which rest on Microsoft's guide. Several pages were read only as search summaries, and the Torq migration guide is behind a form. Cyware is not a source row. The method page sets out how each cell was decided, and the data page has the full table as CSV and JSON.