About Splunk SOAR Automation Broker

You can run actions in playbooks or on an ad hoc basis while investigating a notable in Splunk SOAR. If those actions involve on-premises applications or assets, you must set up and install the Splunk SOAR Automation Broker in order to run those actions. You can use the Splunk SOAR Automation Broker to run actions from Splunk SOAR in your on-premises environment.

Splunk SOAR Automation Broker can be used with either Splunk SOAR (Cloud) or Splunk SOAR (On-premises).

Diagram showing Splunk SOAR Automation Broker used with Splunk SOAR (Cloud):

Diagram showing Splunk SOAR Automation Broker used with Splunk SOAR (On-premises):

Splunk SOAR uses an on-premises application, the Splunk SOAR Automation Broker, to securely run actions through connections to your on-premises tools and applications. Splunk SOAR sends an action request for a specific connector configuration to the Splunk SOAR Automation Broker. In combination with the connector, the Splunk SOAR Automation Broker dispatches the action to the relevant on-premises application.

After the action run completes, the action results are securely communicated to Splunk SOAR using REST and HTTPS.

You don't need the Splunk SOAR Automation Broker to run actions and see the results of those action runs with connections to cloud services.

About the Splunk SOAR Automation Broker container

The Splunk SOAR Automation Broker is delivered as a Docker container.

The base operating system inside the container is fully updated CentOS 7.2009. Each Splunk SOAR Automation Broker release has all operating system patches applied when it is built.

Communications limits

The Splunk SOAR Automation Broker supports transferring action requests or action results and logs up to 100MB in size.

See also

• Docker documentation website: https://docs.docker.com
• CentOS 7.2009 documentation: https://docs.centos.org/en-US/docs/