Playbook Migration
Migrate Your SOAR Playbooks Automatically
D3 porting scripts read the playbooks in your current platform, rebuild the logic inside Morpheus, and hand your team a written list of what still needs a human.
6
Source platforms with published porting coverage
3
Artifact types that port: playbooks, reporting, integrations
800+
Integrations already built, so connector work is configuration
Fixed scope
One program, one agreed finish line, written down first
As of August 2026, SOAR playbooks can be migrated automatically in large part. D3 porting scripts read the playbooks, reports, and integration mappings in your current platform, then rebuild them inside Morpheus. Structural logic ports without a human. Custom code, vendor-specific functions, and steps tied to a tool you are retiring get flagged for human review before anything runs.
Nobody wakes up wanting to migrate playbooks. Something forces the timing. A renewal quote lands higher than last year. A platform change appears on somebody else’s roadmap. An engineer who knew the automation leaves. The work you already paid for is suddenly the thing standing between you and any other decision.
This page describes what D3 ports for you, what your team still reviews, and how the engagement is scoped. Morpheus is the accountable agentic SOC platform, and a full SOAR runs inside it, so the playbooks land in the same platform that triages the alerts.
The Harness
How Automated Playbook Migration Works
A harness is a converter written against one source platform’s export format. It reads that format, maps every step it recognizes, and reports every step it does not.
Every SOAR platform stores its playbooks as structured data. Steps, ordering, branch conditions, inputs, and outputs all live in an exportable format. A harness parses that structure and rewrites it as a Morpheus playbook, step for step, with the same branching and the same order of operations.
The value of the harness is the honesty of its output. Anything it cannot map with confidence comes back on a review list with the source step attached, so your team decides what happens next. When Morpheus is uncertain, it defers to a human.
Playbooks
Step sequence, branch conditions, inputs and outputs, and approval or wait steps come across as structure. Your analysts recognize the flow on sight because the shape of the playbook is preserved.
Reporting
Scheduled reports, dashboard definitions, and metric fields port alongside the playbooks. The board deck your CISO already circulates keeps its columns, which removes a common reason migrations stall.
Integrations
Where your source playbook calls a tool that Morpheus already integrates with, the harness maps the action to the Morpheus connector. Morpheus ships 800+ integrations, so most calls have a target waiting.
Supported Source Platforms
D3 publishes porting coverage for six source platforms. The right column is the honest one. Read it first.
Coverage varies by how much of your automation lives in structured playbook steps and how much lives in custom code. Every environment is different, so the assessment confirms these rows against your actual export before anyone commits to a scope.
| Source platform | What ports automatically | What needs review |
|---|---|---|
| Cortex XSOAR | Playbook task sequence and sub-playbook structure, branching conditions, task inputs and outputs, scheduled report definitions, and integration commands that map to an existing Morpheus connector. | Custom Python automation scripts, content-pack logic with no direct Morpheus equivalent, incident field and layout customizations, and any transformer or filter written in-house. |
| Splunk SOAR | Playbook block sequence and execution order, decision blocks and their conditions, action blocks that map to an existing Morpheus connector, and report and dashboard definitions. | Custom code blocks, embedded search syntax inside playbook steps, apps built in-house, and any playbook that calls another product’s API directly rather than through an app. |
| QRadar SOAR | Workflow, phase, and task structure, task ordering and dependencies, rule and condition logic, notification templates, and report layout definitions. | Custom scripts attached to tasks, functions that call in-house services, dynamic playbook conditions expressed in code, and field customizations that carry business logic. |
| Siemplify | Playbook and block sequence, trigger conditions, case-scoped report definitions, and actions that map to an existing Morpheus connector. | Custom actions written in Python, marketplace integrations with no Morpheus equivalent, environment-specific job configuration, and any logic held in connector settings rather than the playbook. |
| Swimlane | Workflow step sequence, conditional branching, record and field mappings between applications, and dashboard and report definitions. | Custom Python tasks, widget and form logic, record schemas where the schema itself encodes process rules, and any integration built in-house. |
| FortiSOAR | Playbook step sequence, decision and approval steps, module and record field mappings, and report template definitions. | Connectors built in-house, expressions written in templating syntax, playbook steps calling vendor-specific functions with no Morpheus equivalent, and custom module logic. |
How To Read This Table
These platforms appear here because teams migrate away from them, and for no other reason. D3 makes no claim about how well any of them works. If your automation is mostly structured steps, the review column stays short. If your team solved hard problems in custom code, the review column grows, and the assessment will say so before you sign anything.
What a Fixed-Scope Migration Looks Like
Fixed scope means the work is written down and agreed before it starts. You know what is being ported, who reviews it, and what finished looks like.
It starts with an inventory
D3 runs your export through the harness and returns a list of every playbook, its port status, and the specific steps that need a human. Teams routinely find playbooks nobody has run in a year. Those get retired instead of ported.
The scope is agreed in writing
The inventory becomes the statement of work. Which playbooks are in, which are retired, which get rebuilt by hand, and who signs off on each one. Ask any vendor for this document before you commit to a migration.
Review is a joint working session
Your analysts sit with the ported playbook and the original side by side. They confirm the logic, adjust the steps the harness flagged, and approve. The people who will run the playbook are the people who accept it.
Cutover happens in stages
Ported playbooks run in Morpheus while your current platform stays live. You move alert sources over in groups, watch the results, and keep a rollback path until the last group is stable.
Webinar
The Agentic SOC That Refuses to Guess
Agentic investigation on every alert, with evidence your team can trust.
Join us for the first public demo of Morpheus 2
Trust is the real bottleneck in SOC automation. When an AI hands your team a verdict with no visible reasoning, verifying it takes as long as the investigation it replaced. Morpheus 2 shows its work on every alert: findings rated confirmed, inferred or gap, actions held inside guardrails you set, every conclusion traced to evidence. Accountable autonomy. That’s what SOC teams need.
Join us for the first public demo of Morpheus 2 and see what changes for your team when every alert gets a full investigation: no more triage queue backlog, no more midnight escalations that turn out to be nothing, no more choosing which alerts get looked at and which get ignored.
In this webinar, attendees will see:
A workspace built for real threats, not noise
Attack Path Discovery investigate a live alert from entry vector to blast radius
Evidence rating in action: what the AI proved, what it inferred, where the gaps are
Plain-language queries across your stack, no search syntax
AI-built playbooks that orchestrate response, logged before they run
Where the Playbooks Land
Noise Down, Security Up. The migration is the means. This is the destination.
Two products, one contract
The agentic SOC and the SOAR are the same platform. Your ported playbooks execute in the same place the alerts get investigated, under one contract and one audit trail.
The next playbook takes minutes
Morpheus builds playbooks from a plain-language description and shows you the draft before it runs. Any analyst on the shift can author automation, so the migration is the last time you queue behind an engineer.
The budget already exists
Most teams here are holding a renewal quote. The target is parity with the SOAR line item you were already going to sign, with the agentic SOC included in the same platform.
Quiet the Queue
Morpheus investigates up to 95% of alerts end to end in under two minutes. When Morpheus is uncertain, it defers to a human. Your ported playbooks handle the response on the alerts that survive triage.
Keep Control
Four autonomy tiers govern every ported playbook. Tier 1, Deterministic. Tier 2, AI-Assisted. Tier 3, AI-Led. Tier 4, Autonomous. You set the tier per action, and the audit trail produces evidence for your control reviews.
Know Your Bill
Platform Subscription + User Licenses = Your Expected Cost. The AI is in the platform price, not on a usage meter. The $0.97 Standard is the public benchmark for what an investigated alert should cost you.
faqs
Frequently Asked Questions
One answer per source platform, plus the two questions people search before they know which platform they are asking about.
How do I migrate my Cortex XSOAR playbooks?
Export your playbooks from Cortex XSOAR and hand the export to D3. The porting harness reads the task sequence, sub-playbook structure, branching conditions, and task inputs and outputs, then rebuilds them as Morpheus playbooks. Integration commands map to Morpheus connectors where one already exists. Custom Python automations, content-pack logic without a Morpheus equivalent, and incident field customizations come back on a review list with the source attached. The free migration assessment runs your real export and tells you how long that list is before you commit.
How do I migrate my Splunk SOAR playbooks?
Export the playbooks from Splunk SOAR and send the export to D3. The harness reads block sequence and execution order, decision blocks and their conditions, and action blocks, then writes the equivalent Morpheus playbook. Action blocks that call an app map to a Morpheus connector where one exists. Custom code blocks, embedded search syntax inside playbook steps, and apps your team built in-house are flagged for review and rebuilt with your analysts in the no-code builder.
How do I migrate my QRadar SOAR playbooks?
Export your workflows and D3 runs them through the harness. Phase and task structure, task ordering and dependencies, rule and condition logic, notification templates, and report layouts port as structure. Custom scripts attached to tasks, functions that call in-house services, and dynamic conditions expressed in code go on the review list. Morpheus ingests alerts from your existing SIEM after the migration, so you keep detection where it is and move only the response layer.
How do I migrate my Siemplify playbooks?
Export the playbooks and D3 ports the block sequence, trigger conditions, and case-scoped report definitions into Morpheus. Actions that map to an existing Morpheus connector carry over. Custom actions written in Python, marketplace integrations with no Morpheus equivalent, and environment-specific job configuration need review. Teams migrating from Siemplify often hold logic in connector settings rather than in the playbook itself, so the assessment looks there too.
How do I migrate my Swimlane playbooks?
Export the workflows and record schemas together, because Swimlane environments often carry process rules in the record structure rather than only in the workflow. The harness ports step sequence, conditional branching, field mappings between applications, and dashboard and report definitions. Custom Python tasks, widget and form logic, and integrations built in-house are flagged for review. The assessment reports schema-held logic separately so nothing silently disappears at cutover.
How do I migrate my FortiSOAR playbooks?
Export your playbooks and modules and D3 runs the harness against them. Step sequence, decision and approval steps, module and record field mappings, and report templates port automatically. Connectors your team built in-house, expressions written in templating syntax, and steps calling vendor-specific functions without a Morpheus equivalent come back for review. Morpheus ships 800+ integrations, so the response actions in a ported playbook usually have a connector waiting.
Is there a SOAR playbook migration tool?
Yes. D3 maintains porting harnesses for Cortex XSOAR, Splunk SOAR, QRadar SOAR, Siemplify, Swimlane, and FortiSOAR. Each one is written against that platform’s export format. It converts playbooks, reporting, and integration mappings into Morpheus, and it returns a review list for everything it cannot map with confidence. When Morpheus is uncertain, it defers to a human. D3 runs the tool for you as part of a fixed-scope migration program.
How do I export SOAR playbooks?
Every major SOAR platform can export playbook definitions, usually as JSON or YAML, either from the playbook editor or through the platform API. Export the full set rather than a sample, and include report definitions and integration configuration in the same pass. Take the export before your admin access changes hands. D3 accepts the native format and does not ask you to reformat anything by hand.