Splunk® SOAR (On-premises)

Release Notes

Acrobat logo Download manual as PDF


The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Acrobat logo Download topic as PDF

Known issues for

Release 6.2.1

Date filed Issue number Description
2024-04-03 PSAAS-17165 VPE: Datapath within loop block doesn't reflect block name change

Workaround:
Before running a playbook that contains a looped block, make sure that all internal datapath configurations of the looped block are accurate and up-to-date by manually checking that each datapath refers to the correct block name.
2024-03-26 PSAAS-16961 Licensing extension not available

Workaround:
Contact Splunk Support at least 30 days before your license is set to expire.
2024-03-25 PSAAS-16959 Using secret global variables causes AB Test Connectivity/Poll Now to fail

Workaround:
Remove the secret flag from all global environment variables for Test Connectivity to work with AB.
2024-03-13 PSAAS-16695 VPE: Action block using Splunk app marked unconfigured when optional parameters not specified
2024-03-06 PSAAS-16642 VPE: Deleting conditions from a filter block changes the conditions for downstream blocks instead of deleting them

Workaround:
If you have already deleted multiple conditions in the filter block configuration panel:

If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.

  • If the conditions match: No further action is required.
  • If the conditions do not match: For all downstream connections, re-select the condition labels to match the conditions in the filter block configuration panel.

2024-03-06 PSAAS-16641 Global seach checkbox for "Playbook Run" gets unselected when selecting other options

Workaround:
If you are selecting multiple search options, select all other options first, then select the Playbook Run option.
2024-03-04 PSAAS-16560, PSAAS-16564 Git operations on playbook repos fail with "Peer's certificate issuer has been marked as not trusted by the user" when using a custom certificate

Workaround:
There are two options:
  1. Manually configure git to use the certificate that you've previously imported to Splunk SOAR. Log into the system as the user owning the Splunk SOAR installation, using SSH, and execute the following command:
    
    git config --global http.sslCAInfo {PHANTOM_HOME}/etc/cacerts.pem
    
    

    If your Splunk SOAR deployment is a cluster, the git config command will need to be executed on each node in the cluster.

  2. Disable SSL verification for the affected git repo(s). This option is less secure

2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
Last modified on 04 April, 2024
PREVIOUS
Welcome to Splunk SOAR (On-premises) 6.2.1
  NEXT
Fixed issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.2.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters