The SOAR part of Google Security Operations, formerly Siemplify, sold as a cloud service in ingestion-based packages. Pages here cover replacing it with self-hosted Shuffle or Tracecat.
Comparing the SOAR side of Google Security Operations with self-hosted Shuffle: playbooks and blocks against Shuffle workflows, 300+ integrations against Shuffle apps, remote agents against running the whole platform on your network, and what changes when SOAR is no longer bundled with the SIEM.
Google SecOps SOAR against Tracecat for teams that want playbooks, cases and AI agents under their own control: case wall versus Tracecat cases, playbook building, deployment on Docker, Kubernetes or air-gapped clusters, and which Tracecat features need its paid edition.
Moving off Google SecOps SOAR to Shuffle: exporting playbooks and blocks as ZIP files or through GitSync, rebuilding them as Shuffle workflows, replacing integrations and connectors, repointing alert ingestion from the SIEM, and retiring remote agents.
Moving Google SecOps SOAR playbooks and cases to Tracecat: inventorying playbooks, blocks and connectors, translating Python integrations to Tracecat custom actions synced from Git, mapping cases, and cutting over alert sources.
Cost of ownership by component: Google Security Operations packages priced on ingestion with SIEM and SOAR bundled, against self-hosted Shuffle's open-source edition, servers, migration work and the people who maintain workflows, including what you still pay for the SIEM if only SOAR moves.
Getting automation out of Google SecOps SOAR before a move: exporting playbook definitions as ZIP files, using GitSync to push playbooks, blocks, connectors and jobs to Git, what Google says about importing into unrelated systems, and what the exports leave out such as case history.
Google SecOps runs as a cloud service and reaches internal systems through remote agents that pull tasks over the Publisher proxy. For networks that cannot accept that model: running Shuffle or Tracecat entirely inside your own boundary and what you give up from the bundled SIEM.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.