Splunk® Automation Broker

Set Up and Manage the Splunk SOAR Automation Broker

Upgrade or update the Splunk SOAR Automation Broker

Splunk SOAR (Cloud) or Splunk SOAR (On-premises) displays a banner notification when a new release of the Splunk SOAR Automation Broker is available.

The Splunk SOAR Automation Broker runs a process named Watchtower that polls to see if a new version is available. Watchtower will automatically update the Splunk SOAR Automation Broker when a new version is released. No user intervention is required.

Watchtower is only supported on Docker hosts. Podman hosts need to manually upgrade the Splunk SOAR Automation Broker container for new releases.

If you want or need to manually install a Splunk SOAR Automation Broker instance, see Install Splunk Automation Broker when you cannot use DockerHub.

How Watchtower gets new Splunk SOAR Automation Broker images

When you install the Splunk SOAR Automation Broker using the docker-compose.yaml file the image: entry in the automation_broker: stanza contains an URL. That URL is redirected to Docker Hub to get the latest image.

For deployments using Podman instead of Docker, the redirection is not supported. Set the image: entry in docker-compose.yaml to read:

image: docker.io/phantomsaas/automation_broker:<version_number>
Last modified on 29 May, 2024
Customize the Splunk SOAR Automation Broker   Reinstall or revert the Splunk SOAR Automation Broker

This documentation applies to the following versions of Splunk® Automation Broker: current, current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters