Splunk SOAR (On-premises) upgrade overview and prerequisites

Splunk Phantom and Splunk SOAR (On-premises) releases are numbered as <major>.<minor>.<patch>.<build>.

Examples:

• Splunk Phantom 4.10.7.63984 is major version 4, minor version 10, patch version 7, build number 63984.
• Splunk SOAR (On-premises) 5.3.5.97812 major version 5, minor version 3, patch version 5, build number 97812.
• Splunk SOAR (On-premises) 6.0.0.114895 major version 6, minor version 0, patch version 0, build number 114895.
• Splunk SOAR (On-premises) 6.0.1.123902 major version 6, minor version 0, patch version 1, build number 123902.
• Splunk SOAR (On-premises) 6.0.2.127725 major version 6, minor version 0, patch version 2, build number 127725.
• Splunk SOAR (On-premises) 6.1.0.131 major version 6, minor version 1, patch version 0, build number 131.

Upgrade overview checklist

Follow these steps to prepare for and then upgrade :

Step	Tasks	Description
1	Identify your upgrade path.	See: Upgrade path for Splunk SOAR (On-premises) privileged installations Upgrade path for Splunk SOAR (On-premises) unprivileged installations You will need to plan your upgrades by identifying your currently installed Splunk Phantom or Splunk SOAR (On-premises) release, then path to your destination release. You must follow the path from your currently installed release to the desired destination release.
2	Make a full backup of your deployment	Make a full backup of your deployment before upgrading. See Backup or restore your instance in Administer . For single instance deployments running as a virtual machine, you can create a snapshot of the virtual machine instead.
3	Do the prerequisites	See Prerequisites for upgrading . Obtain logins Make sure the instance or cluster nodes have enough available space. Conditional: Turn off warm standby. See Warm standby feature overview Conditional: Turn off scheduled backups. For example, if you scheduled backups with a cron job, deactivate the cron job to turn them off.
4	Prepare your system for upgrade	See Prepare your Splunk SOAR (On-premises) deployment for upgrade.
5	Conditional: Convert a privileged deployment to an unprivileged deployment.	see Convert a privileged Splunk SOAR (On-premises) deployment to an unprivileged deployment.
6	Upgrade	See Upgrade . After all the preparation stages are complete, you can upgrade your instance or cluster. For clustered deployments, after the preparation stages are complete, upgrade your cluster in a rolling fashion, one node at a time.
7	Conditional: Repair indicator hashes for non-federal information processing standards (FIPS) deployments.	If you are upgrading a non-FIPS instance, you must run the following script after running the installation script: repair_520_indicators.sh. That script is located in <$PHANTOM_HOME>/bin/. You may optionally pass the batch size as an argument: repair_520_indicators.sh <batch_size>. The default batch size is 1000. You can restart the script at any time. The script terminates after execution. In clustered configurations, run this script on any single node. In configurations using warm standby, run this script only on the primary system.
8	Conditional: Rerun the setup command for ibackup	See Prepare for a backup in Administer .
9	Conditional: Reestablish warm standby.	See Warm standby feature overview.

Important changes between releases

This table lists versions of Splunk Phantom and Splunk SOAR (On-premises) product where important changes are introduced. Some of these changes may impact your upgrade plans. Review this table carefully before planning your upgrade.

Release	Important changes
4.8.24304	Added support for Python 3.6 for apps
4.9.39220	Removed support for PostgreSQL 9.6 Added support for PostgreSQL 11.6
4.10.x	Major.minor.patch.build numbering system introduced End of support for RHEL and CentOS 6 Added support for Python 3.6 for playbooks Support for TLS 1.1 ends with Splunk Phantom 4.10.5
5.0.1	The name of the product changed from Splunk Phantom to Splunk SOAR (On-premises)
5.2.1	FIPS support becomes available for new, unprivileged deployments of Splunk SOAR (On-premises) 5.2.1. Splunk SOAR (On-premises) deployments installed in FIPS-compatible mode can only be upgraded in FIPS-compatible mode.
5.3.0	Python upgraded from 3.6 to 3.9 The format for Splunk SOAR (On-premises) installation packages and scripts were overhauled in 5.3.0 There is no longer a separate installation package for systems with limited Internet access, the TAR file for installations contains all required dependencies. Expanded support for PostgreSQL versions to 11.x
5.3.3	Support for Python 2 was deprecated
5.3.4	Support for Python 2 was removed. Playbooks and apps written in python 2 are disabled.
5.3.5	Support for privileged installation of Splunk SOAR (on-premises) ends. Any privileged installations must be converted to unprivileged for further upgrades.
5.3.6	5.3.6 includes improvements to the upgrade process. You can upgrade privileged deployments of Splunk Phantom release 4.10.7 or Splunk SOAR (On-premises) releases 5.0.1 through 5.3.5 directly to release 5.3.6. 5.3.6 includes improvements to the tools for migrating a privileged deployments to unprivileged. Support for privileged installation of Splunk SOAR (on-premises) ends. Any privileged installations must be converted to unprivileged for further upgrades.
5.5.0	Support added for Red Hat Enterprise Linux 8 Support added for Amazon Linux 2
6.0.0	Default administrative user is now called soar_local_admin. For details, see Welcome to Splunk SOAR (On-premises) 6.0.0 in the Splunk SOAR (On-premises) Release Notes.
6.0.1	You can now upgrade directly to the latest Splunk SOAR (On-premises) version. Encryption algorithm for SAML updated from rsa-1_5 to rsa-oaep-mgf1p.
6.0.2	Includes all updates found in 6.0.0 and 6.0.1. Fixes issues with 6.0.0 and 6.0.1.
6.1.0	Unprivileged deployments of Splunk Phantom 4.10.7 and all unprivileged deployments of Splunk SOAR (On-premises) can now upgrade from any earlier release directly to release 6.1.0

Prerequisites for upgrading Splunk SOAR (On-premises)

You need the following information before beginning your upgrade:

• Logins
  • For unprivileged deployments, you need the login credentials for the user account that runs . For new AMI versions of , the user account is phantom.

    See What's new in 6.0.0 in Release Notes for important information about the change to the default administrator user account.

  • Your Splunk Phantom Community portal login.
• A minimum of 5GB of space available in the /tmp directory on the instance or cluster node.
• Make note of the directory where is installed.
  • On an unprivileged AMI, or virtual machine image deployment - /opt/phantom, also called <$PHANTOM_HOME>.
  • On an unprivileged deployment - the home directory of the user account that will run , also called <$PHANTOM_HOME>.
• Conditional: If your deployment uses the warm standby feature, turn off warm standby. See Warm standby feature overview.
• Conditional: Turn off scheduled backups. For example, if you scheduled backups with a cron job, deactivate the cron job to turn them off.

Upgrade Splunk SOAR (On-premises)

Prepare your system for upgrade by completing the prerequisites listed in Prepare your Splunk SOAR (On-premises) deployment for upgrade.