Do you need to move playbooks at all?
Many lean teams have few SOAR playbooks, or none. If that is you, skip to the next lesson; our scoring page shows that the top of the ranking does not change when the playbook criterion is set to zero. This lesson is for teams with an estate of playbooks that encode years of decisions.
The three routes
- Translate. The vendor converts existing playbooks into its own format. Mate Security says it translates SOAR playbooks into Gamebooks, replacing brittle API calls while keeping custom logic, and reports one customer moving 711 playbooks into 10 Gamebooks; that figure is Mate's.
- Rebuild. You recreate the logic in the vendor's workflow engine, often helped by natural-language builders. Torq describes agentic and deterministic workflows created from natural language.
- Keep. The SOAR stays in place for response and the AI SOC investigates in front of it. Dropzone AI hands response to connected SOARs such as Cortex XSOAR, Splunk SOAR and Tines.
Before you move anything
Make an inventory: each playbook, its trigger, the tools it calls, the actions it takes, the approvals it requires, and when it last ran. Retire what has not run in a year. Mark the playbooks that encode compliance requirements, because those need the strictest tests.
Five tests for any moved playbook
- Same inputs, same decision. Replay a set of past alerts through the old and new logic and compare outcomes.
- Same actions. Confirm every action the old playbook took is still taken, against the same tool, with the same parameters.
- Same approvals. Check that every approval step still exists and still blocks the action until a person approves.
- Same failure handling. Break a dependency on purpose, for example a tool that times out, and see what the new logic does.
- Same record. Confirm the audit trail shows at least what the old one showed.
Where translation and rebuild differ
Translation promises to keep custom logic you may have forgotten you wrote, which is valuable and also a risk: forgotten logic is untested logic. Rebuild forces you to decide what each playbook should do today, which takes longer but cleans the estate. Either way, run old and new side by side in recommend-only mode before switching.
A short checklist for the vendor
- Which of our playbook steps cannot be translated or rebuilt?
- How are approvals represented in your format?
- Can we run old and new in parallel, and compare outcomes automatically?
- Who does the work: your team, ours, or a partner?
Get the answers in writing before the pilot starts. Playbook work is where timelines slip, and a clear split of who translates, who tests and who signs off keeps a small team from becoming the bottleneck in its own migration.