Splunk® SOAR (On-premises)

Release Notes

Acrobat logo Download manual as PDF


The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Welcome to 5.3.6

This release of is intended to improve and simplify the upgrade process for users with privileged deployments of Splunk Phantom or Splunk SOAR (On-premises). It serves as an intermediate point between older, privileged deployments and new, unprivileged deployments.

  • You can now upgrade from privileged deployments of Splunk Phantom release 4.10.7 or any release of Splunk SOAR (On-premises) 5.0.1 through 5.3.4 to release 5.3.6.
  • After upgrading to release 5.3.6, you can then convert your deployment to an unprivileged deployment, and upgrade directly to release 6.1.1.
  • If you already have 5.3.5 deployed, you can convert your deployment to an unprivileged deployment, then upgrade directly to release 6.1.1

Do not use this release to create new deployments of Splunk SOAR (On-premises).

Use this release to upgrade from your current privileged deployment of Splunk Phantom 4.10.7 or Splunk SOAR (On-premises) releases 5.0.1 through 5.3.4.

If you are upgrading a privileged deployment of Splunk Phantom 4.10.7 or Splunk SOAR (On-premises) releases 5.0.1 through 5.3.4, upgrade to release 5.3.6, convert your deployment to unprivileged, then upgrade again directly to Splunk SOAR (On-premises) release 6.1.1 or higher.

If you have a privileged deployment of Splunk SOAR (On-premises) release 5.3.5, convert your deployment to unprivileged, then upgrade directly to Splunk SOAR (On-premises) release 6.1.1 or higher.

To learn how to upgrade see Splunk SOAR (On-premises) upgrade overview and prerequisites.

Support for privileged installations ended with release 5.4.0

Splunk SOAR (On-premises) removed support for privileged installations, for both new deployments or upgrades of existing deployments in release 5.4.0.

The 5.3.3, 5.3.4, 5.3.5 and this 5.3.6 release include tools for migrating your existing deployment from a privileged deployment to an unprivileged one. These tools can be used any time after upgrading to release 5.3.3. If you need assistance to plan for migrating your deployment, contact your account team.

See Convert a privileged deployment to an unprivileged deployment in Install and Upgrade Splunk SOAR (On-premises).

What's new in 5.3.6

This release of includes the following enhancement.

Feature Description
New upgrade path You can now upgrade your privileged deployment directly from Splunk Phantom release 4.10.7 or releases 5.0.1 through 5.3.4 to release 5.3.6, smoothing and simplifying the path to upgrading to release 6.1.1. See Splunk SOAR (On-premises) upgrade overview and prerequisites.
Last modified on 19 September, 2023
  NEXT
Known issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.3.6

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters