Upgrade a privileged cluster

Perform the following tasks to upgrade your cluster. These tasks apply to privileged clusters running on local hardware, or privileged clusters running in Amazon Web Services.

For each SOAR node, follow the upgrade instructions, one node at a time:

Use the TAR file for Splunk SOAR (On-premises) release 5.3.6 to upgrade your privileged Splunk Phantom 4.10.7 or Splunk SOAR (On-premises releases 5.0.1 through 5.3.4. Do not use this TAR file to create a new deployment.

1. Visit the web site to register and create an account. After have signed up, you can download installation packages from the Free Trial button. You do not need to repeat this step.
2. Read upgrade overview and prerequisites. You do not need to repeat this step.
3. Prepare your system for upgrade. See Prepare your Splunk SOAR (On-premises) deployment for upgrade.
4. Restart the operating system if you did not recently restart it as part of the preparations in Step 3.
   This step is required to ensure that the upgrade completes successfully and efficiently.
   As the root user:

   reboot

5. After the system restarts, log in to the operating system as either the root user or a user with sudo privileges.
6. Remove any previous upgrade's <$PHANTOM_HOME>/splunk-soar directory.

   rm -rf <$PHANTOM_HOME>/splunk-soar

7. Download the privileged installer from the instructions sent to you by Support. The installer is packaged with static versions of the product's dependencies when the product is built. The installer is named in the format splunk_soar-priv-<major>.<minor>.<patch>.<build>-<commit_short_sha>-el7-x86_64.tgz
8. Extract the TGZ file you downloaded into the /opt/phantom directory using tar -xf <installer>.tgz .
9. Make sure that that your current installation of is running.

   <$PHANTOM_HOME>/bin/start_phantom.sh

10. Change directory to the <$PHANTOM_HOME>/splunk-soar directory.

    cd <$PHANTOM_HOME>/splunk-soar

11. The installer package you extracted creates a file called soar-install in the <$PHANTOM_HOME>/splunk-soar directory. Run that script:

    ./soar-install --upgrade --with-apps

    You can see the full list of arguments for the soar-install script by using the --help option.

12. After the upgrade is complete, remove installation package by deleting the <$PHANTOM_HOME>/splunk-soar directory.

    rm -rf <$PHANTOM_HOME>/splunk-soar

Convert an existing privileged cluster to an unprivileged cluster

To convert your existing privileged cluster to an unprivileged one, see Convert a privileged deployment to an unprivileged deployment in Install and Upgrade Splunk SOAR (On-premises).