Inventory before you translate
Export the full playbook catalogue and rank by (a) fire count last 12 months, (b) TP outcome rate, (c) whether the playbook actually completed vs stopped at a manual step. Anything that fired zero times or never completed is technical debt. Leave it behind.
Group survivors into three buckets: notify-only (Slack/ticket), enrich-only (add IOC context), and act (containment/rollback). Notify-only workflows collapse into a single ManySignal notification action. Enrich-only usually becomes a triage question resolver. Only act-workflows need real translation.
Map to the ManySignal action catalogue
Every write action in ManySignal is a typed catalogue entry with schema, reversibility, rollback definition, permission class, and connector requirement. Legacy SOAR steps become one or more catalogue calls.
For every playbook you translate, capture the blast radius: how many entities does the worst-case run touch? That number drives the approval-gated threshold. Anything that could touch more than a handful of entities requires approval by default.
# workflows/identity-takeover-response.yaml
key: identity.takeover_response
mode: deterministic
review_state: approved
nodes:
- id: evidence
type: action
catalog_key: evidence.capture_state
autonomy: autonomous
- id: notify
type: action
catalog_key: communication.notify_slack
params: { channel: "#soc-p1" }
- id: approve
type: human_prompt
prompt: "Revoke sessions for {{identity.name}}?"
timeout: 5m
- id: revoke
type: action
catalog_key: identity.revoke_sessions
depends_on: approve
autonomy: approve_gated
Calibrate autonomy without breaking trust
Ship every migrated workflow in recommend-only mode first. Run for 30 days. Track TP rate at your target confidence threshold. If precision >95% within the intended blast radius, promote to approve-gated. If precision holds >99% over 60 days and blast radius stays bounded, consider autonomous.
Autonomy is per action class per tenant. A notify_slack action can be autonomous immediately; a revoke_sessions action might take 3 months of shadow to earn autonomy. Publish the criteria so operators know the ladder is real, not arbitrary.
Cutover: 30 days shadow, 30 dual-run, sunset
Same pattern as SIEM migration. Shadow mode runs both systems; alerts fire twice; workflows execute only in the legacy SOAR. Dual-run makes ManySignal authoritative for the migrated workflows while legacy handles the rest. Sunset removes legacy after two consecutive months of parity.
Retain read-only access to the legacy SOAR run history for audit, incident replay, and compliance. Six months is the standard retention window.
Key takeaways
- Do not port every playbook. Inventory + rank + trim first.
- Every action is a catalogue entry with blast radius; that drives the approval threshold.
- Autonomy is earned per action class per tenant.
- 30/30/sunset cutover, same as SIEM migration. Keep legacy read-only for 6 months.