Troubleshoot pairing Splunk Enterprise Security with Splunk SOAR

Troubleshoot pairing Enterprise Security with Splunk SOAR. If your Splunk Enterprise Security should be paired with Splunk SOAR, but the Splunk SOAR Pairing page does not display either the successful pairing message, or a list of role mappings, do the following steps:

1. Log into Splunk Enterprise Security. From the Splunk bar, select Settings, then Data Inputs.
2. Find and select Create and Store SOAR JWK key pair.
3. Look at the entry for main. If it is Enabled select Disable.
4. Select main to open the settings.
5. Set the Refresh time to 0.
6. Select Save.
7. On the entry for main select Enabled.
8. Select main to open the settings.
9. Set the Refresh time to 1296000.
10. Select Save.
11. Login in to Splunk SOAR to validate pairing.