Splunk® SOAR (Cloud)

Release Notes

Acrobat logo Download manual as PDF


The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Acrobat logo Download topic as PDF

Known issues for

March 28, 2024 Release 6.2.1

Date filed Issue number Description
2024-04-03 PSAAS-17165 VPE: Datapath within loop block doesn't reflect block name change

Workaround:
Before running a playbook that contains a looped block, make sure that all internal datapath configurations of the looped block are accurate and up-to-date by manually checking that each datapath refers to the correct block name.
2024-04-03 PSAAS-17136 Action Run History still showing old action events
2024-03-26 PSAAS-16961 Licensing extension not available

Workaround:
Contact Splunk Support at least 30 days before your license is set to expire.
2024-03-25 PSAAS-16959 Using secret global variables causes AB Test Connectivity/Poll Now to fail

Workaround:
Remove the secret flag from all global environment variables for Test Connectivity to work with AB.
2024-03-22 PSAAS-16934 Evidence tab screen goes blank if artifact is marked as evidence

Workaround:
use a different CEF field name that's not "tags"
2024-03-13 PSAAS-16695 VPE: Action block using Splunk app marked unconfigured when optional parameters not specified
2024-03-06 PSAAS-16642 VPE: Deleting conditions from a filter block changes the conditions for downstream blocks instead of deleting them

Workaround:
If you have already deleted multiple conditions in the filter block configuration panel:

If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.

  • If the conditions match: No further action is required.
  • If the conditions do not match: For all downstream connections, re-select the condition labels to match the conditions in the filter block configuration panel.

2024-03-06 PSAAS-16641 Global seach checkbox for "Playbook Run" gets unselected when selecting other options

Workaround:
If you are selecting multiple search options, select all other options first, then select the Playbook Run option.
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-08-25 PSAAS-14609 AB: Broker status should be updated if the broker directory is no longer present
2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.

November 30, 2023 Release 6.2.0

Date filed Issue number Description
2024-03-22 PSAAS-16933 Playbook API: phantom.update() and phantom.set_status() present as having successfully completed but don't actually update the event

Workaround:
The issue occurs when multiple playbooks are attempting to update a single container at the same time. This can be avoided in a few ways:
  • If you have a parent and child playbook that each update fields in the container, you may consider calling those child playbooks synchronously, so that they are not capable of performing updates at the same time
  • You may consider bundling your container updates into a single playbook

2024-03-13 PSAAS-16695 VPE: Action block using Splunk app marked unconfigured when optional parameters not specified
2024-02-28 PSAAS-16529 When navigating back from investigation page to the analyst queue, stale filters are selected
2024-02-21 PSAAS-16467 Investigation for actiond down for the stack acn-soar
2024-02-20 PSAAS-16452, PSAAS-16372 Classic to Modern Playbook conversion errors

Workaround:
* Layout completely jumbled in Modern playbook (MINOR, But annoying)

this can should be resolved by clicking auto-arrange

2024-02-15 PSAAS-16431, PSAAS-16963, PSAAS-16962 Automation Broker: Actions intermittently hang for Automation Broker when there are connection issues

Workaround:
# Check if the action completed successfully
  1. Cancel the hanging action
  2. If the action did not complete successfully, re-run the action.
2024-02-09 PSAAS-16357 Playbook Converter: Datapaths not present in modern datapath picker for custom function and playbook blocks

Workaround:
Rename the affected block to be the same as the function name.

For example, if the function name is "cf_local_generated_1", change the block name to "cf_local_generated_1".

2024-02-06 PSAAS-16309 Unauthorized login attempts
2024-01-30 PSAAS-16206 Global Environment Variables are incorrectly applied by the Automation Broker when the variable is named in all lowercase letters.

Workaround:
Use uppercase letters only.
2024-01-30 PSAAS-16209 Ability to change user id and group id of AB broker splunk_data folder
2024-01-22 PSAAS-16122 Saving playbooks to a local repo fails with 'Push master failed: (branch is currently checked out)'

Workaround:
Operate in repo configured with external resources
2024-01-19 PSAAS-16089 Missing notification for inactivity timeout
2024-01-18 PSAAS-16087 MC Setup: SOAR Repo roles failed to be created

Workaround:
The customers will need to manually create the repo roles listed in the doc

{noformat}mc_soar_repo_edit_<repo_name> mc_soar_repo_execute_<repo_name> mc_soar_repo_view_<repo_name>{noformat}

Once the appropriate roles are assigned to the user, they can run the actions/playbooks

2024-01-16 PSAAS-16049 Fix asset name for playbook converter
2024-01-16 PSAAS-16048 Fix asset name for playbook converter
2024-01-09 PSAAS-15999 SOAR Cloud : UF forwarding not honoring indexer port configuration
2024-01-03 PSAAS-15959 ForwarderGroup TCP token can be accidentally cleaned up if forwarder group is inactive

Workaround:
If a SOAR Cloud customer has a Splunk Enterprise forwarder group which is not working due to a deleted tcp token they can recreate the group and the tcp token will be recreated
2023-12-12 PSAAS-15821 Global search not working for custom fields
2023-12-11 PSAAS-15750 VPE: Downstream block invoked twice from two upstream code blocks join

Workaround:
Detach one of the upstream blocks and run the blocks in sequence to avoid a join.
2023-12-08 PSAAS-15709 Playbook API: phantom.format throws error when a value is not found on the datapath
2023-12-06 PSAAS-15694 Indicators page shows empty table for non-admin users
2023-12-06 PSAAS-15695 JSON viewer for input playbooks - analyst view- has clickable URLs

Workaround:
None
2023-12-05 PSAAS-15685 Naming a forwarder group "splunk" breaks forwarding

Workaround:
Delete the forwarder group named "splunk" and recreate it with some other name.
2023-11-30 PSAAS-15648 MC SOAR customers are not able to modify the data types of the MC Forwarder Group

Workaround:
If a customer wants to enable more data types for forwarding to their MC Splunk, SOAR engineers must enable them manually by ssh-ing to the stack and updating the forwarder group via python shell. If forwarding doesn't work, it may be due to issue 3. To fix that we need a credentials package from MC and we need to update the MC forwarder group's Template:Credentials package field with the credentials package and we need to reinstall the app on the forwarder.

See [1]

[2]

2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-11-28 PSAAS-15612 Changing multiple incident fields in Mission Control results in duplicate SOAR update messages
2023-11-28 PSAAS-15610 Widget visibility is not saved via "manage widgets"
2023-11-22 PSAAS-15543 Test connectivity for asset might result in "failed to send" and HTTP 500 "internal server" error for POST to /rest/asset/{id}

Workaround:
If your connectivity test runs longer than 30 seconds:
  • Keep the "Test Connectivity" window open and wait for the test to complete.
  • Ignore the 500 "internal server error" and the "Failed to send" notification.

2023-11-07 PSAAS-15338 The Repo Permissions in the user modal does not show permissions

Workaround:
Check for the assigned roles permissions for the repos
2023-10-27 PSAAS-15211 MC block: Action 'get task file' is no longer available in MC 3.0

Workaround:
Use get task action instead.
2023-10-27 PSAAS-15202 Password Vault: Asset not removed from "Assets with enabled password manager" table if all credential fields removed

Workaround:
No workaround.

If an asset in the "Assets with enabled password manager" table is empty, it is not available for use. It still exists in the table because a credential management field was deleted, preventing deletion of the asset from the table.

2023-10-27 PSAAS-15201 Password Vault: "Assets with enabled password manager" table can lead to Apps page without an asset selected

Workaround:
This issue occurs when you select the Edit button to view an asset from the "Assets with enabled password manager" table, then, after viewing its App configuration page, you use the browser's back button to return to the table. When you select Edit to view another asset from the table, the Apps configuration page for that asset is not pre-filled with the asset name and information.

After you have viewed one asset configuration page, use one of the following workarounds to avoid the issue:

  • Refresh the Password Vault browser page before selecting the Edit button for each asset you want to view.
  • Remember the name of the asset you want to view. Select the Edit button for that asset to open its Apps page. The Asset field will be blank. Select the name of the asset you want to view.
  • Right-click or Control-click the Edit button next to an asset to open it in a new tab.

2023-10-26 PSAAS-15199 If the CyberArk instance is down and an action is run, the response message is not clear
2023-10-25 PSAAS-15176 VPE Playbook Conversion: Opening some of the converted PBs show "Discard Changes" button without changes made

Workaround:
When you open a newly converted playbook, select Save to regenerate and save the new code.

If you select Discard Changes before you have made any changes, the playbook code and JSON files are not changed.

2023-10-20 PSAAS-15120 Adding an empty repository on SOAR fails

Workaround:
Ensure that at least one commit is pushed to the playbook repo before adding it to SOAR
2023-10-20 PSAAS-15119 VPE Playbook conversion: Extra path added when converting classic VPE playbook to modern playbook

Workaround:
If your classic playbook has connections that are very close to each other, the modern playbook might create an extra connection.

Before you convert a playbook, spread out your playbook blocks so your connections are not close or overlapping. Then convert the playbook.

Review and test newly converted playbooks before marking them as active to ensure blocks and connectors appear and work correctly.

2023-09-05 PSAAS-14697, PSAAS-14655, PAPP-32725 Images are not appearing in action's custom view on SOAR (Cloud) and (On-premises) versions 6.1.1 and higher
2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-06-27 PSAAS-13913 VPE: After clicking Discard Changes button, blocks show error "Reconfigure Invalid Data Path"

Workaround:
Need to not save the playbook and refresh the page
2023-05-22 PSAAS-13496 App Editor: Setting default app action booleans to 'false' does not work.
2023-02-13 PSAAS-12282 Mission Control: Using "delete_event" in MC Block does not delete the artifact on SOAR

Workaround:
*After an event was deleted:
  1. Use debug custom function to find soar_container_id
  2. Go to SOAR Container and delete the artifact.
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.

September 6, 2023 Release 6.1.1

Date filed Issue number Description
2023-08-25 PSAAS-14609 AB: Broker status should be updated if the broker directory is no longer present

July 11, 2023 Release 6.1.0

Date filed Issue number Description
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2024-02-15 PSAAS-16431, PSAAS-16963, PSAAS-16962 Automation Broker: Actions intermittently hang for Automation Broker when there are connection issues

Workaround:
# Check if the action completed successfully
  1. Cancel the hanging action
  2. If the action did not complete successfully, re-run the action.
2024-02-06 PSAAS-16309 Unauthorized login attempts
2024-01-30 PSAAS-16206 Global Environment Variables are incorrectly applied by the Automation Broker when the variable is named in all lowercase letters.

Workaround:
Use uppercase letters only.
2023-12-11 PSAAS-15750 VPE: Downstream block invoked twice from two upstream code blocks join

Workaround:
Detach one of the upstream blocks and run the blocks in sequence to avoid a join.
2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-10-06 PSAAS-14969 Update from source control of external repo to pull a new Custom Function also creates a new playbook

Workaround:
To avoid this issue:

When using Update From Source Control, always select Force Update.

If you have already encountered this issue:

You have playbooks you didn't create, with names very similar to the custom function name, like custom_functions/<my_custom_function>.

Do not delete these extra playbooks, because that will also delete the custom function. Delete the Source Control repository and recreate it to remove the extra playbooks.

2023-10-04 PSAAS-14948 "validate parameters" button in action modal says "save" instead
2023-09-14 PSAAS-14784 SOAR gives a "502 bad gateway" error for all SAML logins if a metadata endpoint fails to respond.
2023-09-08 PSAAS-14740 In App editor, Console output is not visible properly in Dark Theme
2023-08-29 PSAAS-14627 VPE: Code from one utility block might be copied into another utility block in the same playbook

Workaround:
In the Python Playbook Editor of the VPE, manually edit the affected blocks to remove duplicate codes.


To keep track of changes you make, clone the playbook before each edit.

2023-08-24 PSAAS-14607 Boolean parameter in playbook considered as string
2023-08-21 PSAAS-14497, PSAAS-14560 VPE: Reversion fails for playbooks with periods in their names

Workaround:
Do not use periods in playbook names. If you have a period in the playbook name, reversion will fail.
2023-08-15 PSAAS-14461 Playbooks not running on container. psycopg2.errors.UntranslatableCharacter is observed in logs.
2023-08-14 PSAAS-14440 Cannot delete all custom fields from UI

Workaround:
When deleting custom fields, leave at least one custom field in the list.
2023-08-11 PSAAS-14413 Special characters are removed while downloading the file from Vault
2023-08-02 PSAAS-14223 "Run automatically when" appears on input playbooks; designed only for automation playbooks

Workaround:
This feature is designed to work on automation playbooks, not input playbooks.

Any updates you make in this section will not affect your input playbooks.

2023-07-26 PSAAS-14172, PSAAS-14173 The delete_containers.pyc script omitted from SOAR 6.1.0 builds.

Workaround:
The delete_containers.pyc script was omitted from SOAR 6.1.0 builds.

Users who need to remove containers from their SOAR deployments can use the data retention and management tools described in the topic Use data retention strategies to schedule and manage your database cleanup in Administer .

2023-07-24 PSAAS-14159 Automation Broker: Jira 'get attachment' action fails over AB due to SSL check error

Workaround:
When the Jira onPrem asset is configured without "Verify server certificate" parameter and the asset is connected over an Automation Broker on a SOAR Cloud instance, get attachments action will fail with SSL certificate error.

To fix this issue, perform either of these actions:

  • In the asset settings, select Verify server certificate.
  • Pair the Automation Broker without TLS certificate check by using the -e PHANTOM_HTTPS_STRICT_TLS_AUTODETECT=0 -e PHANTOM_HTTPS_STRICT_TLS=0  option.

2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-07-18 PSAAS-14102 The original State file is replicated with app dir's state file

Workaround:
Remove the state file from the app dir.
2023-07-18 PSAAS-14116 App Editor Console Output has black fonts in dark theme

Workaround:
Use the light theme.
  1. Click your account name on the top right, then select Account Settings.
  2. Select the Light Theme, then select Save Changes.

2023-07-14 PSAAS-14056 Community repo playbooks updated from source control give error "Ref '6.1' did not resolve to an object"

Workaround:
Select the Force Update checkbox, then select Update.
2023-07-11 PSAAS-14004, PAPP-31256 Zoom, MS Graph, EWS for Office apps not installed/upgraded on SOAR 6.1.0

Workaround:
If you are using one of the following apps, manually reinstall or upgrade it from Splunkbase.
  • Zoom app, version 2.1.0
  • MS Graph for Office365, version 2.8.0
  • EWS for Office 365, version 2.15.0
2023-07-09 PSAAS-13990 : Test connectivity over Automation Broker is not working after setting the public key in ssh repository
2023-06-30 PSAAS-13971 VPE: opening playbook hangs on "loading playbook editor"; console shows error messages "TypeError: Cannot destructure property '{property}' of '{value}' as it is undefined."
2023-06-26 PSAAS-13898 Splunk SOAR's cron jobs generate output, which fills up mail boxes over time

Workaround:
Empty the Splunk SOAR user's mailbox. For example, if the Splunk SOAR user is phantom, you can empty the mailbox by running
rm /var/mail/phantom
2023-06-23 PSAAS-13889 Images within app documentation are not being rendered
2023-06-21 PSAAS-13845 VPE stuck in 'Loading Playbook Editor' after minor playbook change.

Workaround:
Right click on VPE and then select inspect then display none.

This disables the 'playbook loading' screen.

Reverted to the last playbook revision: Select settings then revision history.

Now reapply your reversed changes to the playbook.

2023-06-17 PSAAS-13813 encryption_helper.encrypt fails when encrypting data larger than 4096 bytes

Workaround:

For EWS for Office365 version 2.14.0 or lower, use Azure authentication mechanism instead of Azure Interactive authentication.

2023-06-12 PSAAS-13723 Playbooks Listing Page: Slow to load when there are many playbook runs record
2023-06-07 PSAAS-13666 VPE: Blocks custom named 'container' and 'container_0' produce the same python function name

Workaround:
Avoid using custom block names that end in "container" and "container_0".
2023-06-05 PSAAS-13766 Microsoft AD LDAP app fails with "No module named 'adldap_consts'" error message

Workaround:
# Clear the local cache on the Automation Broker for the given app. This example shows steps to clear the local cache on Automation Broker for a sample maxmind app:

{noformat}splunk_user@518d6331a46d:/splunk_data/apps$ cd maxmind_c566e153-3118-4033-abda-14dd9748c91a/ splunk_user@518d6331a46d:/splunk_data/apps/maxmind_c566e153-3118-4033-abda-14dd9748c91a$ ls -l total 4 drwxr-xr-x 6 splunk_user splunk_user 4096 Jun 7 15:43 2.2.5 splunk_user@518d6331a46d:/splunk_data/apps/maxmind_c566e153-3118-4033-abda-14dd9748c91a$ rm -rf 2.2.5{noformat}

  1. After you clear the cache, run a test conn or any action to re-download the app to the Automation Broker from SOAR.
2023-05-22 PSAAS-13496 App Editor: Setting default app action booleans to 'false' does not work.
2023-03-07 PSAAS-12591 VPE: Artifact labels in datapaths are not universally supported

Workaround:
Use a format block to convert datapath results to strings then use the format block's output as the input to downstream action blocks.
2023-02-13 PSAAS-12282 Mission Control: Using "delete_event" in MC Block does not delete the artifact on SOAR

Workaround:
*After an event was deleted:
  1. Use debug custom function to find soar_container_id
  2. Go to SOAR Container and delete the artifact.
2022-11-28 PSAAS-11237 Details for playbook runs don't update in window from the Investigation page

Workaround:
Click the "x" and then click on the desired playbook run in the queue
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.

February 22, 2023 Release 6.0.0

Date filed Issue number Description
2023-03-03 PSAAS-12470 custom app install fails with "Multiple app directories detected." after upgrading from 5.5.0 to 6.0.0

Workaround:
recompile the app under soar 6.0.0 via the command line using "phenv compile_app -t -a {app_directory}"
2023-03-02 PSAAS-12445 Nginx '502 Bad Gateway' after submitting a large batch of events
2023-03-01 PSAAS-12397 App editor fails to load assets in edit mode for draft apps

Workaround:
Workaround 1: Publish the app so it is not longer a DRAFT, do the tests with the existing assets and then edit again to carry on with development. That generates a new version of the app for every test/publish action made


Workaround 2: create a new asset while testing in DRAFT mode. That works as well but then when the app is published, that asset becomes an orphaned asset that can no longer be used unless reassigned. There is a new orphan asset for every time the app is published

2023-02-27 PSAAS-12369 Logrotate fails because of syntax error in the config file

Workaround:
Change the prerotate section of opt/phantom/etc/logrotate.d/phantom_logrotate.conf to the following: 

/opt/phantom/var/log/phantom/*.log {
  copytruncate
  rotate 10
  size 50M
  start 1
  create 0660
}

2023-02-27 PSAAS-12370 Playbook output variables replaced with {outputPath} after upgrade

Workaround:
Manually discover the incorrect datapath and re-select all datapaths that were renamed.
2023-02-20 PSAAS-12349 Mission Control: Splunk users without an email address cannot change their user settings in SOAR

Workaround:
For affected users in a paired Mission Control + SOAR environment, add an email address to the user's account in your Splunk Cloud deployment .
2023-02-16 PSAAS-12333 Playbooks that open with smart block context warnings will disable the debugger and display 'Discard Changes' button

Workaround:
Save the playbook. The debugger is re-enabled and the Discard Changes button no longer displays.
2023-02-16 PSAAS-12331 Naming blocks the same for utility block causes the blocks to sync
2023-02-15 PSAAS-12299 Apps Update does not display available new versions of unconfigured bundled apps

Workaround:
Applies to apps included with Splunk SOAR that are unconfigured (listed under the Unconfigured Apps tab). This does not apply to apps you manually installed by clicking Install App.
  1. Configure an asset for that app.
  2. Return to the Apps list.
  3. Click App Updates to see any available updates for that configured app.

2023-02-15 PSAAS-12317 API block, Custom Function with list type inputs do not update datapaths when upstream block custom name is changed

Workaround:
Configure the datapath manually.
2023-02-13 PSAAS-12282 Mission Control: Using "delete_event" in MC Block does not delete the artifact on SOAR

Workaround:
*After an event was deleted:
  1. Use debug custom function to find soar_container_id
  2. Go to SOAR Container and delete the artifact.
2023-02-13 PSAAS-12284 Playbook input variables are marked as invalid within an input playbook

Workaround:
There is no workaround for this at the moment, but playbooks with block warnings can still be saved/run as usual. The warnings do not impact basic playbook functionality in any way.
2023-02-06 PSAAS-12198 App action links within app documentation do not work

Workaround:
Scroll down the page to view the documents or find by using CTRL-F search function.
2023-02-01 PSAAS-12155 Adding multiple inputs to a previously saved custom function - not in alphabetical order - invalidates custom function.

Workaround:
  1. Edit the custom function again. Click Generate. Two function headers display.
  2. Manually delete the old function header, located between the ## Custom Code Goes Below This Line ## comment lines. You cannot delete the new function header, because it is locked.

    3. The custom function will use the newly generated function header and function properly.


2023-01-26 PSAAS-12057 Document known issue / Workaround In App Editor, the AB(Automation Broker) configuration is ignored

Workaround:
If the asset you're using while debugging in the App Editor is configured to use an Automation Broker this setting is ignored. Launching the app/debugging will not route to the automation broker, instead it always runs locally in the cloud instance.

To work around this issue:

  1. Publish the app.
  2. Run the published version of the app.
  3. Clone the published app so we can use the editor again.
  4. Manually change the cloned settings added to the json config.
  5. Delete the published app and its related asset.
  6. (Optional) create a new asset instead of deleting the previous one.
  7. Make the required code modifications.
  8. Repeat the process to debug again.
2023-01-25 PSAAS-12052 Mission Control:VPE: Action block cannot add top-level custom field for Event

Workaround:
Type the custom field in the action block input field.
2022-11-28 PSAAS-11237 Details for playbook runs don't update in window from the Investigation page

Workaround:
Click the "x" and then click on the desired playbook run in the queue

Versions 5.0.0 - 5.5.0

January 4, 2023 release 5.5.0 update

This is an update to the 5.5.0 release. Known issues are included in the table for the December 14 release.

December 14, 2022 release 5.5.0

Date filed Issue number Description
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2024-02-15 PSAAS-16431, PSAAS-16963, PSAAS-16962 Automation Broker: Actions intermittently hang for Automation Broker when there are connection issues

Workaround:
# Check if the action completed successfully
  1. Cancel the hanging action
  2. If the action did not complete successfully, re-run the action.
2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-05-02 PSAAS-13313 ui regression: "TypeError: this.state.appCategories.map is not a function" and blank screen when opening app in app editor

Workaround:
none at this time
2023-04-28 PSAAS-13290 Toggling delay timer in one block causes all other action blocks to toggle delay timer.

Workaround:
Avoid toggling delay timer for blocks that do not want delays. Instead, reduce the delay to 0 minutes.
2023-04-06 PSAAS-12976 VPE: Manually selecting an asset deletes block configuration

Workaround:
Create a new block and copy the datapaths from the python editor view.
2023-03-22 PSAAS-12767 App install with Chrome browser: Browser crashes when installing a TAR or TGZ file

Workaround:
This issue occurs when adding a new app using Chrome version 111.0.5563.

To avoid this issue, use a different browser.

2023-03-13 PSAAS-12637 Documentation: Cannot render specific div's from README.md properly on documentation page
2023-03-07 PSAAS-12591 VPE: Artifact labels in datapaths are not universally supported

Workaround:
Use a format block to convert datapath results to strings then use the format block's output as the input to downstream action blocks.
2023-02-18 PSAAS-12347 VPE: Playbooks cannot be canceled by the customer
2023-02-16 PSAAS-12333 Playbooks that open with smart block context warnings will disable the debugger and display 'Discard Changes' button

Workaround:
Save the playbook. The debugger is re-enabled and the Discard Changes button no longer displays.
2023-02-15 PSAAS-12311, PSAAS-12328 Prompt block icon disappear after creating more than one empty questions
2023-02-13 PSAAS-12284 Playbook input variables are marked as invalid within an input playbook

Workaround:
There is no workaround for this at the moment, but playbooks with block warnings can still be saved/run as usual. The warnings do not impact basic playbook functionality in any way.
2023-02-06 PSAAS-12198 App action links within app documentation do not work

Workaround:
Scroll down the page to view the documents or find by using CTRL-F search function.
2023-01-31 PSAAS-12122, PSAAS-11650 VPE missing inputs issue affecting playbook blocks

Workaround:
None
2023-01-26 PSAAS-12057 Automation Broker (AB) configuration is ignored in the app editor

Workaround:
If the asset you're using while debugging in the App Editor is configured to use an Automation Broker this setting is ignored. Launching the app/debugging will not route to the automation broker, instead it always runs locally in the cloud instance.

To work around this issue:

  1. Publish the app.
  2. Run the published version of the app.
  3. Clone the published app so we can use the editor again.
  4. Manually change the cloned settings added to the json config.
  5. Delete the published app and its related asset.
  6. (Optional) create a new asset instead of deleting the previous one.
  7. Make the required code modifications.
  8. Repeat the process to debug again.
2023-01-20 PSAAS-11979 VPE: clicking on a block does not bring up the sidebar for editing conditions
2023-01-20 PSAAS-11965 Splunk app "run query" action runs infinitely on PSaaS instance
2023-01-11 PSAAS-11841 Upgrading a SOAR instance to 5.5 does not change the community repo branch to 5.5

Workaround:
Deleting the community repository and readding it with the correct branch.
2023-01-10 PSAAS-11802 Artifact save invokes indicator extraction when indicator feature is disabled.
2023-01-09 PSAAS-11797 App actions fail due to unescaped null characters (PSAAS-10127)
2023-01-04 PSAAS-11694 VPE/prompt: "Could not find 'undefined' in users or roles" during playbook runs after upgrading from 5.4.0 and editing/saving the playbook

Workaround:
Edit the prompt block and re-select the user or role.

The following error message displays, but you can save and run the playbook.

approver must be a `object` type, but the final value was: `null` (cast from the value `"Administrator"`). If "null" is intended as an empty value be sure to mark the schema as `.nullable()`

2022-12-23 PSAAS-11658, PSAAS-11004 VPE: Utility blocks with more than one API call do not save parameter values

Workaround:
Use one utility block per API call.
2022-12-22 PSAAS-11638 VPE: delay in populating block outputs/datapath picker when playbook fully loaded

Workaround:
To fully populate the datapath picker list when configuring a block in the Visual Playbook Editor:
  1. Click outside the block configuration.
  2. Then click back into the block configuration.

2022-12-22 PSAAS-11648 Analyst Queue: When applying filters for owner for cases and events, the metrics at the top of the case screen do not change (containers are filtered)

Workaround:
none at this time
2022-12-15 PSAAS-11514 VPE smart block context not taking into account custom datapaths

Workaround:
Use custom code to manually add in the correct custom datapath into the python generation, if known.
2022-12-07 PSAAS-11389 Git app: Action git commit fails

Workaround:
The issue affects the git push command. Use HTTPS or git protocol instead of HTTP.
2022-12-05 PSAAS-11327, PSAAS-9665 VPE: Debugger hangs when running playbook; It goes blank and needs refresh
2022-12-05 PSAAS-11328 VPE Empty Variables with inconsistent use of quotes
2022-11-29 PSAAS-11245 Automation Broker: When getting new credentials for broker, UI gives incorrect docker command

Workaround:
Use the following command, instead of the one shown on the screen:

docker exec -ti <container_id> python3 /splunk/broker/bin/update_creds.py --new-creds "<copied_creds>"

docker <container_id> restart


2022-11-28 PSAAS-11237 Details for playbook runs don't update in window from the Investigation page

Workaround:
Click the "x" and then click on the desired playbook run in the queue
2022-11-28 PSAAS-11242 VPE: After correct reconfiguration, "invalid resource" warning persists within subplaybook block

Workaround:
The warning will not be shown if the user returns to the state 'Unconfigured' of the block and then proceeds to configure again
2022-11-18 PSAAS-11181 Fix page crash on load for blocks using external resources
2022-11-18 PSAAS-11190 VPE: Block Names with Container - A block name with "container" cannot share its results in other blocks in the Visual Editor

Workaround:
Do not use the word 'container' in playbook block names.
2022-10-31 PSAAS-11001 Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition
2022-09-07 PSAAS-10127 Playbooks using Threat Grid or urlscan.io app hang on the detonation action

Workaround:
Upgrade the app you are using.
  1. From the Apps page, click App Updates.
  2. Upgrade the app to the appropriate version:
    • Threat Grid: upgrade to version 2.3.1 or higher
    • urlscan.io: upgrade to version 2.3.0 or higher

2022-07-07 PSAAS-9417, PSAAS-9599 Data/Graphs missing on Executive Report after 5.3.2 upgrade
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.
2021-09-30 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags

Workaround:
Parse the result manually to exclude the span tags around the playbook name.

October 27, 2022 release 5.4.0

Date filed Issue number Description
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-09-14 PSAAS-14784 SOAR gives a "502 bad gateway" error for all SAML logins if a metadata endpoint fails to respond.
2023-08-11 PSAAS-14413 Special characters are removed while downloading the file from Vault
2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-05-02 PSAAS-13313 ui regression: "TypeError: this.state.appCategories.map is not a function" and blank screen when opening app in app editor

Workaround:
none at this time
2023-04-28 PSAAS-13290 Toggling delay timer in one block causes all other action blocks to toggle delay timer.

Workaround:
Avoid toggling delay timer for blocks that do not want delays. Instead, reduce the delay to 0 minutes.
2023-04-06 PSAAS-12976 VPE: Manually selecting an asset deletes block configuration

Workaround:
Create a new block and copy the datapaths from the python editor view.
2023-02-16 PSAAS-12333 Playbooks that open with smart block context warnings will disable the debugger and display 'Discard Changes' button

Workaround:
Save the playbook. The debugger is re-enabled and the Discard Changes button no longer displays.
2023-02-15 PSAAS-12311, PSAAS-12328 Prompt block icon disappear after creating more than one empty questions
2023-02-01 PSAAS-12147 System health charts truncate values
2023-01-26 PSAAS-12057 Automation Broker (AB) configuration is ignored in the app editor

Workaround:
If the asset you're using while debugging in the App Editor is configured to use an Automation Broker this setting is ignored. Launching the app/debugging will not route to the automation broker, instead it always runs locally in the cloud instance.

To work around this issue:

  1. Publish the app.
  2. Run the published version of the app.
  3. Clone the published app so we can use the editor again.
  4. Manually change the cloned settings added to the json config.
  5. Delete the published app and its related asset.
  6. (Optional) create a new asset instead of deleting the previous one.
  7. Make the required code modifications.
  8. Repeat the process to debug again.
2023-01-13 PSAAS-11884 analyst queue: unexpected behavior when clearing previously added 'owner' filters
2023-01-09 PSAAS-11797 App actions fail due to unescaped null characters (PSAAS-10127)
2022-12-20 PSAAS-11587 A successful completion of called playbook in Synchronous mode, over-writes failure result in calling playbook

Workaround:
None
2022-12-20 PSAAS-11581 PlaybookRunEx::UpdateStatus fails to update when playbook run is very old.
2022-12-16 PSAAS-11546 Numeric input is parsed as integer and does not match the data type specified by the spec
2022-12-09 PSAAS-11423 Custom Function Editor: Not saving data type change

Workaround:
Changing the code forces the type update.
2022-12-08 PSAAS-11401 Automation Broker generates a high volume of extraneous audit log records.
2022-12-05 PSAAS-11328 VPE Empty Variables with inconsistent use of quotes
2022-11-30 PSAAS-11293 VPE: Debugger crashed in 5.4.0; Playbook run fails if it has an action with a 2+ minutes timer

Workaround:
No workaround, you could not use the timer but there are actions taking more than 2 minutes to complete and that cannot be changed.
2022-11-18 PSAAS-11182 "New events" counter increasing when Dynamic Updates are turned off
2022-11-18 PSAAS-11190 VPE: Block Names with Container - A block name with "container" cannot share its results in other blocks in the Visual Editor

Workaround:
Do not use the word 'container' in playbook block names.
2022-11-09 PSAAS-11068 Port forward from NRI port to 443 doesn't work on local machine.
2022-11-09 PSAAS-11077 Cloud : Remote search indexing : One event per day is missed

Workaround:
n/a
2022-11-09 PSAAS-11073 Action run limit not enforced before server restart
2022-11-08 PSAAS-11121 AppUpdate should continue to work with custom apps that have invalid versions

Workaround:
Uninstall the custom apps that are causing the blockage.
  1. To identify those custom apps, run the following script 
    
phenv phantom_shell
apps = App.objects.filter(disabled=False)
for app in apps:
  if not app.known_versions:
    print(app)

print('done looking up custom apps')
  2. Use the AppUpdate wizard to update known app. See Splunk SOAR Connector for a list of apps that you can upgrade with the wizard.
  3. Reinstall those custom apps

Repeat these steps each time you want to upgrade certified apps.

2022-11-03 PSAAS-11049 Search setting failing on test connection.
2022-10-31 PSAAS-11004, PSAAS-11658 VPE: Values entered into custom function/Utility input arguments are deleted or modified

Workaround:
  1. Within the Visual Playbook Editor (VPE), populate a field in the utility block configuration panel.
  2. When complete, close the configuration panel.
  3. Re-open the configuration panel to populate another field.
  4. Repeat until you have completed all necessary fields.

2022-10-31 PSAAS-11001 Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition
2022-10-13 PSAAS-10703 Default workbook is reset on upgrade if the original default has been removed
2022-09-26 PSAAS-10454 UI error when navigating to case evidence tab caused by linked container that was removed by retention.

Workaround:
None.
2022-09-07 PSAAS-10107 Status of Case is missing from Report

Workaround:
None known
2022-09-07 PSAAS-10127 Playbooks using Threat Grid or urlscan.io app hang on the detonation action

Workaround:
Upgrade the app you are using.
  1. From the Apps page, click App Updates.
  2. Upgrade the app to the appropriate version:
    • Threat Grid: upgrade to version 2.3.1 or higher
    • urlscan.io: upgrade to version 2.3.0 or higher

2022-08-17 PSAAS-9891 Indicators are visible with labels that roles do not allow
2022-07-07 PSAAS-9417, PSAAS-9599 Data/Graphs missing on Executive Report after 5.3.2 upgrade
2022-04-29 PSAAS-8776 Investigation page: Widget layout and visibility is not saved via "manage widgets"

Workaround:
none known at this time
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.
2021-09-30 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags

Workaround:
Parse the result manually to exclude the span tags around the playbook name.

September 28, 2022 release 5.3.5

Date filed Issue number Description
2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-01-09 PSAAS-11797 App actions fail due to unescaped null characters (PSAAS-10127)
2022-11-18 PSAAS-11190 VPE: Block Names with Container - A block name with "container" cannot share its results in other blocks in the Visual Editor

Workaround:
Do not use the word 'container' in playbook block names.
2022-11-11 PSAAS-11118, PSAAS-8901 VPE 2: Adding a parameter to an action block deletes another parameter.

Workaround:
  1. Within the Visual Playbook Editor (VPE), populate a field in the action block configuration panel.
  2. When complete, close the configuration panel.
  3. Re-open the configuration panel to populate another field.
  4. Repeat until you have completed all necessary fields.

2022-11-08 PSAAS-11121 AppUpdate should continue to work with custom apps that have invalid versions

Workaround:
Uninstall the custom apps that are causing the blockage.
  1. To identify those custom apps, run the following script 
    
phenv phantom_shell
apps = App.objects.filter(disabled=False)
for app in apps:
  if not app.known_versions:
    print(app)

print('done looking up custom apps')
  2. Use the AppUpdate wizard to update known app. See Splunk SOAR Connector for a list of apps that you can upgrade with the wizard.
  3. Reinstall those custom apps

Repeat these steps each time you want to upgrade certified apps.

2022-10-31 PSAAS-11004, PSAAS-11658 VPE: Values entered into custom function/Utility input arguments are deleted or modified

Workaround:
  1. Within the Visual Playbook Editor (VPE), populate a field in the utility block configuration panel.
  2. When complete, close the configuration panel.
  3. Re-open the configuration panel to populate another field.
  4. Repeat until you have completed all necessary fields.

2022-10-31 PSAAS-11001 Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition
2022-10-20 PSAAS-10820 Receiving system generated emails with Account Notifications turned off

Workaround:
Email filter.
2022-09-26 PSAAS-10454 UI error when navigating to case evidence tab caused by linked container that was removed by retention.

Workaround:
None.
2022-09-20 PSAAS-10287 Interval/Schedule ingestion settings cannot be changed

Workaround:
Changing an asset's ingest settings does not correctly update the UI. The setting is changed, but the UI does not show the correct state. If you change the ingest settings on an app's asset from Interval to Schedule or Off the UI continues to show the setting as Interval.

You can examine the JSON output of a REST request to determine the actual status of the asset's setting.

  1. Log in to your Splunk SOAR deployment.
  2. In a new browser tab, use this REST request. 
    https://<Splunk SOAR deployment>/rest/asset?pretty=true&_special_app_info=true&page_size=0&_filter_id=<asset id>
    Replace <Splunk SOAR deployment> and <asset id> with the URL for your SOAR deployment and the asset id of the asset whose status you want to verify.
  3. Look for the "configuration" object and check the value of "polling". 
    {...
"configuration": {"ingest": {"interval_mins": "30", "container_label": "events", "polling": false}
}
    When the value is false, polling is disabled. When the value is true, polling is enabled.

2022-09-07 PSAAS-10107 Status of Case is missing from Report

Workaround:
None known
2022-09-07 PSAAS-10127 Playbooks using Threat Grid or urlscan.io app hang on the detonation action

Workaround:
Upgrade the app you are using.
  1. From the Apps page, click App Updates.
  2. Upgrade the app to the appropriate version:
    • Threat Grid: upgrade to version 2.3.1 or higher
    • urlscan.io: upgrade to version 2.3.0 or higher

2022-08-17 PSAAS-9891 Indicators are visible with labels that roles do not allow
2022-08-01 PSAAS-9665, PSAAS-11327 VPE: SOAR UI hangs in VPE debug and UI will go blank and need refresh
2022-07-07 PSAAS-9417, PSAAS-9599 Data/Graphs missing on Executive Report after 5.3.2 upgrade
2022-04-29 PSAAS-8776 Investigation page: Widget layout and visibility is not saved via "manage widgets"

Workaround:
none known at this time
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.
2021-09-30 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags

Workaround:
Parse the result manually to exclude the span tags around the playbook name.

August 31, 2022 release 5.3.4

Date filed Issue number Description
2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2023-01-09 PSAAS-11797 App actions fail due to unescaped null characters (PSAAS-10127)
2022-11-18 PSAAS-11190 VPE: Block Names with Container - A block name with "container" cannot share its results in other blocks in the Visual Editor

Workaround:
Do not use the word 'container' in playbook block names.
2022-11-11 PSAAS-11118, PSAAS-8901 VPE 2: Adding a parameter to an action block deletes another parameter.

Workaround:
  1. Within the Visual Playbook Editor (VPE), populate a field in the action block configuration panel.
  2. When complete, close the configuration panel.
  3. Re-open the configuration panel to populate another field.
  4. Repeat until you have completed all necessary fields.

2022-11-08 PSAAS-11121 AppUpdate should continue to work with custom apps that have invalid versions

Workaround:
Uninstall the custom apps that are causing the blockage.
  1. To identify those custom apps, run the following script 
    
phenv phantom_shell
apps = App.objects.filter(disabled=False)
for app in apps:
  if not app.known_versions:
    print(app)

print('done looking up custom apps')
  2. Use the AppUpdate wizard to update known app. See Splunk SOAR Connector for a list of apps that you can upgrade with the wizard.
  3. Reinstall those custom apps

Repeat these steps each time you want to upgrade certified apps.

2022-10-31 PSAAS-11004, PSAAS-11658 VPE: Values entered into custom function/Utility input arguments are deleted or modified

Workaround:
  1. Within the Visual Playbook Editor (VPE), populate a field in the utility block configuration panel.
  2. When complete, close the configuration panel.
  3. Re-open the configuration panel to populate another field.
  4. Repeat until you have completed all necessary fields.

2022-10-31 PSAAS-10997 Playbook decision block convert boolean strings to boolean values

Workaround:
no workaround
2022-10-31 PSAAS-11001 Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition
2022-10-04 PSAAS-10582 UI crash: opening container with a HUD CARD using a Custom Field and a list value leads to a blank page.

Workaround:
Use pin type = data instead of card
2022-09-26 PSAAS-10454 UI error when navigating to case evidence tab caused by linked container that was removed by retention.

Workaround:
None.
2022-09-20 PSAAS-10287 Interval/Schedule ingestion settings cannot be changed

Workaround:
Changing an asset's ingest settings does not correctly update the UI. The setting is changed, but the UI does not show the correct state. If you change the ingest settings on an app's asset from Interval to Schedule or Off the UI continues to show the setting as Interval.

You can examine the JSON output of a REST request to determine the actual status of the asset's setting.

  1. Log in to your Splunk SOAR deployment.
  2. In a new browser tab, use this REST request. 
    https://<Splunk SOAR deployment>/rest/asset?pretty=true&_special_app_info=true&page_size=0&_filter_id=<asset id>
    Replace <Splunk SOAR deployment> and <asset id> with the URL for your SOAR deployment and the asset id of the asset whose status you want to verify.
  3. Look for the "configuration" object and check the value of "polling". 
    {...
"configuration": {"ingest": {"interval_mins": "30", "container_label": "events", "polling": false}
}
    When the value is false, polling is disabled. When the value is true, polling is enabled.

2022-09-16 PSAAS-10265 NMAP App not compatible with Automation Broker

Workaround:
Build a custom automation broker image with nmap installed and run the App via AB.

Note that this is probably unsupported by us.

2022-09-14 PSAAS-10263 "500 Server Error" when downloading vault file with name containing a line feed

Workaround:
rename it directly in the DB
2022-09-08 PSAAS-10158 Upgrades may fail on PrepSystem step due to a cp failure with "Text File Busy"

Workaround:
This occurs when there's an active cron job for SOAR running when the upgrade starts. Wait for the processes using python3.9 to complete and then retry the upgrade
2022-09-08 PSAAS-10205 Incorrect notification when connecting to Splunkbase
2022-09-07 PSAAS-10107 Status of Case is missing from Report

Workaround:
None known
2022-09-07 PSAAS-10127 Playbooks using Threat Grid or urlscan.io app hang on the detonation action

Workaround:
Upgrade the app you are using.
  1. From the Apps page, click App Updates.
  2. Upgrade the app to the appropriate version:
    • Threat Grid: upgrade to version 2.3.1 or higher
    • urlscan.io: upgrade to version 2.3.0 or higher

2022-08-11 PSAAS-9793 Custom field message has broken link to documentation

Workaround:
Follow these links to learn more about using custom fields in playbooks:
2022-08-01 PSAAS-9665, PSAAS-11327 VPE: SOAR UI hangs in VPE debug and UI will go blank and need refresh
2022-07-07 PSAAS-9417, PSAAS-9599 Data/Graphs missing on Executive Report after 5.3.2 upgrade
2022-04-29 PSAAS-8776 Investigation page: Widget layout and visibility is not saved via "manage widgets"

Workaround:
none known at this time
2022-04-08 PSAAS-8541 Unreadable characters sporadically appear in UI

Workaround:
Refresh the browser to reload the page.

July 28, 2022 release 5.3.3

Date filed Issue number Description
2022-07-22 PSAAS-9574 soar-prepare-system appears to get stuck after InstallPhantomDependencies

Workaround:
The problem is that the progress spinner is overwriting a prompt asking if you'd like to run an optional step. To resolve,
  1. Quit the pending run of soar-prepare-system using ctrl+c
  2. Run soar-prepare-system again, this time with either the --no-spinners flag to disable the spinners, or the --no-prompt flag to skip the prompts
2022-07-19 PSAAS-9531 Upgrades fail with error "Failed to trust git directory" when there exist playbook repos with spaces in their names

Workaround:
Follow these steps to mitigate this issue during your upgrade to version 5.3.2.
  1. Edit install/install_steps/git_repos.py. Change lines 37 and 46. Wrap {git_repo} in escaped quotes. 
    
37     cmd=f"config --global --unset safe.directory \"{git_repo}\"",

46     cmd=f"config --global --add safe.directory \"{git_repo}\"",

    Other versions may have similar code that needs to be wrapped in escaped quotes.

  2. Verify .soar-continue contains {"continue_from": "GitRepos", "cluster_phase": "NONE"}
  3. Re-run the soar-install command.

June 22, 2022 release 5.3.2

This release of Splunk SOAR (Cloud) has no known issues.

April 11, 2022 release 5.3.1

Date filed Issue number Description
2022-04-14 PSAAS-8617 Ingestion failures

Workaround: If the ingestd daemon is still running on the instance but ingestion has stopped, contact Support. The ingestd daemon will be restarted on the instance.

2022-04-12 PSAAS-8569 5.2.1 -> 5.3.x upgrades fail if custom pip packages have been installed and the system cannot directly reach pypi.org without a proxy

Workaround: Perform one of these two operations (up to customer discretion):

  1. Look into the {{<PHANTOM_HOME>/usr/local/customer_requirements.txt}} file and acquire all the packages therein; it's likely they were installed for a reason by the customer, so this is probably the most correct action. The commands for acquiring the package may vary depending on the customer's environment; however, it should generally be a pip install: {noformat}phenv python3 -m pip install -r customer_requirements.txt{noformat}
  2. OR, you can delete the entire {{<PHANTOM_HOME>/usr/local/customer_requirements.txt}} file (or any package listed in it) so the system does not attempt to install anything. This action may result in customer playbooks, custom functions, or even locally-written apps to fail since they might expect pip packages to exist that are no longer installed

Regardless of whether action (a) or action (b) was taken, the customer can continue the upgrade by re-running Template:Soar-install after performing either remediation above

2022-02-11 PSAAS-7604 Deleting Source Control repo doesn't remove the playbooks

Workaround: If customer has command line access:

  1. Verify that the repo is marked as Template:Disabled=t in the Template:Scm table (SELECT * FROM scm;)
  2. Verify that associated playbooks are marked as Template:Disabled=t and Template:Disabled=f in the Template:Playbook table (SELECT * FROM playbook WHERE id=<scm_id>;)
  3. Mark all associated playbooks as Template:Disabled=t (UPDATE playbook SET disabled=t WHERE scm_id=<scm_id>;)

January 26, 2022 release 5.2.1

Date filed Issue number Description
2022-01-20 PSAAS-7307 Cloned Assets after upgrade will have secrets encrypted incorrectly.After upgrade, for any cloned assets, you will need to manually re-enter any passwords or secret environment variables.
Of the Splunk certified apps this will only happen for a shared asset on the WMI and LDAP apps.
2021-12-17 PSAAS-7028 VPE 2.0 - UI issue causing dot separation in playbooks which worsens over time

November 17, 2021 release 5.1.0

Date filed Issue number Description
2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2022-03-17 PSAAS-8132 Saving an event without change increases/decreases event SLA
2022-02-18 PSAAS-7649 uwsgi stops handling requests with SIGNAL QUEUE IS FULL error

Workaround:
Restart uwsgi
2022-02-15 PSAAS-7633 C++ log truncation can result in bad json for very long messages
2022-01-27 PSAAS-7399 Ingestion stalls when assets are modified while ingesting
2022-01-20 PSAAS-7300 Investigation page Workbook pane: "run playbook" dialog box incorrectly placed upon clicking 2nd and subsequent playbooks to launch

Workaround:
even though the "run playbook" dialog box's placement is incorrect and the dialog box's 'cancel' button does not function, the "run playbook" button does function and does launch the designated playbook
2022-01-10 PSAAS-7173 Analyst Queue: Event filtering only allows one user at a time

Workaround:
Craft filter in browser URL using SOAR user ID's.
2022-01-05 PSAAS-7132 Triggering playbook runs from the UI can hang the webserver if only one worker is available
2021-12-29 PSAAS-7069 Phantom App: Automation Broker not able to add empty file into the Vault
2021-12-09 PSAAS-6899 VPE - Boolean parameter in action block does not display as 'set'(checked) for a default value of 'true' in JSON
2021-11-18 PSAAS-6603 IDP-initiated SAML authentication succeeds, but presents an error to the user

Workaround:
-
2021-11-12 PSAAS-6440 App Wizard UI does not fully display when using the light UI theme.

Workaround:
Use the dark UI theme instead of the light UI theme.
2021-11-05 PSAAS-6253 On an upgraded instance, updating the Maxmind app returns error.

Workaround:
Edit the apps' asset settings. Select a label in the Ingest Settings tab.
2021-10-15 PSAAS-5765 Splunkbase: Login And Install button in Login modal only does the login, not installation.

Workaround:
Use the Install button to install a single app or click the Install All button to install all the displayed apps.
2021-10-15 PSAAS-5768 phantom.get_run_data() sometimes returns invalid JSON

Workaround:
Compare the output of phantom.get_run_data to the empty string, and set the value to "null" if they match. Requires custom code.
2021-10-12 PSAAS-5674, PSAAS-8570 VPE 2.0 - Only shows first 19 custom functions in the Utility block custom function list

Workaround:
Change the order of "sort-by". Changing it once, you'll see Z-A. If you want to see A-Z, change the sort order again.  

You can also use "search" to search for a specific custom function.

2021-10-12 PSAAS-5681 Global environment variables are not honored when debugging actions in the App Wizard's editor.
2021-10-12 PSAAS-5682 App Wizard's editor prevents a user from saving apps that have fewer than two actions.

Workaround:
You can create at least two no-op actions for an app and the editor's validation will pass.

The behavior was intended to enforce that apps must implement an action besides "test connectivity", but it failed to account for special circumstances and that not all apps support any actions at all

2021-10-07 PSAAS-5598 The App Wizard's editor allows the user to create multiple actions with the same name, which generates conflicting function names.

Workaround:
All function names are converted to lowercase.

Avoid creating actions with the same lowercase name. If you do create actions with the same lowercase name, you must manually change the name of one of the misnamed actions and update the code of your app to match the new function names. 

2021-10-07 PSAAS-5600 Changing app versions in the App Wizard's editor changes the behavior of edit & clone workflows by leaving old versions of the draft app on the system instead of overwriting them.
2021-10-07 PSAAS-5602, PSAAS-5595 App Wizard's editor is missing support for configuring ingestion assets and testing ingestion actions.
2021-10-07 PSAAS-5572 In the App Wizard's editor, the "Draft Apps" listing does not accurately report the number of supported actions.
2021-10-07 PSAAS-5597, PSAAS-5592, PSAAS-5606 App Wizard's editor: Misconfiguring a new action in the "Add Action" modal may cause subsequent usages of the modal to generate TypeErrors.

Workaround:
Exit and restart the App Wizard's editor reset the modal window state.
2021-10-07 PSAAS-5622, PSAAS-5588 APP Editor: Jump to code doesn't work when errors are present in source (Documentation)
2021-10-06 PSAAS-5509 VPE 2: Block mode Python code should show the actual line number
2021-09-30 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags

Workaround:
Parse the result manually to exclude the span tags around the playbook name.
2021-07-21 PSAAS-3827 VPE 2.0: Changing block name doesn't change its downstream datapath

August 24, 2021 release 5.0

Date filed Issue number Description
2023-11-29 PSAAS-15638 Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively

Workaround:
If using the REST API directly, add a sort parameter to the URL: 
https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly: 


# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

2023-07-19 PSAAS-14125 Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions.

Workaround:
Use an account with the Administrator role to delete any Splunk SOAR Automation Brokers as needed.
2022-02-15 PSAAS-7633 C++ log truncation can result in bad json for very long messages
2021-10-15 PSAAS-5768 phantom.get_run_data() sometimes returns invalid JSON

Workaround:
Compare the output of phantom.get_run_data to the empty string, and set the value to "null" if they match. Requires custom code.
2021-10-07 PSAAS-5573, PSAAS-6581 Investigation page: Related Events modal has Permission Error
2021-10-06 PSAAS-5542 Issue with allowing roles to pass permission checks in unauthorized areas when performing reporting operations
2021-09-30 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags

Workaround:
Parse the result manually to exclude the span tags around the playbook name.
2021-09-15 PSAAS-3564 Automation Broker: Unable to pair broker: brokerd caught in some endless loop preventing pairing
2021-08-30 PSAAS-3375 Garbage string printed for client id in AB logs during unregistration

Workaround:
This is because client_id is a hash and needs to be printed with %x. We are instead using %s which is causing the issue.

 

2021-08-25 PSAAS-3343 Some actions fail with "failed to send request to AB" on AB 64172
2021-08-24 PSAAS-3311 VPE - Classic editor throws uncaught reference. Clear cache and refresh to fix.

Workaround:
Empty cache and hard reload
2021-08-23 PSAAS-3289 Can't Delete Value from Org Id/Set Domain for Thycotic password vault
2021-08-19 PSAAS-3246 Calling playbook APIs get_tasks, add_task, and set_owner raise an error

Workaround:
None at this time
2021-08-18 PSAAS-3232, PSAAS-3271 When an admin is configuring source control, it is unclear that a github personal access token is valid input.
2021-08-02 PSAAS-2782 Unable to rotate encryption keys in the Automation Broker
2021-08-02 PSAAS-2781 Broker sometimes fail to pair with Cloud SOAR instance
2021-07-14 PSAAS-2558 Approval - two different status after stopping approval process
2021-07-13 PSAAS-2548 Add related_category and remove tenant_info from ActionRun's deletion audit records
2021-07-09 PSAAS-2510 App RSA Archer: Unable to see the app's custom view for the "list ticket" action when the result count is 100 or more items.
Date filed Issue number Description
2021-08-19 MCSOAR-4367 VPE 2.0 - Playbook version in settings doesn't update
2021-08-13 MCSOAR-4328 VPE 2.0 - Keyboard shortcuts don't work with code focused
2021-08-13 MCSOAR-4336 VPE 2.0 - Fullscreen in playbook editor hides the debugger/editor button
2021-07-29 MCSOAR-4216 VPE 2.0 - Debug console output should scroll down automatically when running
2021-07-29 MCSOAR-4207 VPE 2.0 - Unable to select "keyword arguments" to pass into utility custom function
2021-07-29 MCSOAR-4197 VPE 2.0 - Playbook Save fails when Unicode is used in Commit Message
2021-07-21 MCSOAR-4143 VPE 2.0 - Changing block name doesn't change its downstream datapath
2021-07-20 MCSOAR-4140 VPE 2.0 - No warning on block that has deleted/invalid datapath
2021-07-16 MCSOAR-4122 VPE 2.0 - Hotkeys: Shortcut for showing available hotkeys only works when Settings is open
2021-06-30 MCSOAR-4106 VPE 2.0 - No warning when asset in action block is not available
2021-06-30 MCSOAR-4100 VPE 2.0 - After dragging an arrow from the start block in Firefox, there's no pop-up to create a new block.
2021-06-30 MCSOAR-4097 VPE 2.0 - Visual errors in Safari
2021-06-30 MCSOAR-4101 VPE 2.0 - Unicode not working on playbook title

Versions 4.12.0 - 4.12.3

July 28, 2021 release 4.12.3

Date filed Issue number Description
2022-05-05 PSAAS-8830 Excessive DB usage during asset or ingestion settings updates.
2021-08-19 PSAAS-3246 Calling playbook APIs get_tasks, add_task, and set_owner raise an error

Workaround:
None at this time
2021-07-28 PSAAS-2735 Connectors are unable to execute java related commands using run_ext_command() in SOAR (cloud).
2021-07-22 PSAAS-2681 Playbook action hangs for over 30m then fails on broker
2021-07-16 PSAAS-2591 Asset Proxy Settings: Previously configured HTTP or HTTPS Proxy not working as intended

Workaround:
* Determine if your proxy is an HTTP or HTTPS proxy.
  • If you have an HTTP proxy and your asset settings have proxy variables starting with https://<proxy_ip>, replace them with http://<proxy_ip>
  • If you have an HTTPS proxy and your asset settings have proxy variables starting with http://<proxy_ip>, replace them with https://<proxy_ip>


2021-06-07 PSAAS-2054 VPE: Naming block name "Summary" makes Decision/Filter block throws error

Workaround:
Don't use use the word "Summary" in investigate blocks
2021-06-07 PSAAS-2056, PSAAS-2157 Home Page: Uses pull-down list populated with multiple duplicate names because it includes deleted users
2021-05-05 PSAAS-2436 Changing an artifact's tenancy will not update it in the indicator table

June 25, 2021 release 4.12.2

Date filed Issue number Description
2021-07-16 PSAAS-2597, PSAAS-2689 Playbook Editor: Error returns a JSON block instead of a formatted error message.
2021-07-09 PSAAS-2510 App RSA Archer: Unable to see the app's custom view for the "list ticket" action when the result count is 100 or more items.
2021-06-15 PSAAS-2226, PSAAS-1798 Playbook action fails with "Timed out waiting for connector to bind back on port!" during performance longevity test
2021-06-08 PSAAS-2081, PSAAS-1798, PSAAS-2242 Playbook action fails intermittently with error message"Failed to send request to Automation Broker."
2021-05-20 PSAAS-1881 Action Broker action concurrency: asset concurrency limit changes are only applied when broker is restarted.
2021-05-07 PSAAS-1758 Playbook debug output doesn't print the playbook, repo, and user names on the first statement

June 10, 2021 release 4.12.1

Date filed Issue number Description
2021-06-15 PSAAS-2226, PSAAS-1798 Playbook action fails with "Timed out waiting for connector to bind back on port!" during performance longevity test
2021-06-08 PSAAS-2081, PSAAS-1798, PSAAS-2242 Playbook action fails intermittently with error message"Failed to send request to Automation Broker."
2021-06-01 PSAAS-2028 Investigation - Artifacts dropdown list not closed after selection
2021-05-25 PSAAS-1947 Onboarding artifact with IP 60.163.90.8 leads to app error message
2021-05-25 PSAAS-1960 Automation Broker: Cannot handle very large downloads or POSTs
2021-05-20 PSAAS-1881 Action Broker action concurrency: asset concurrency limit changes are only applied when broker is restarted.
2021-05-07 PSAAS-1758 Playbook debug output doesn't print the playbook, repo, and user names on the first statement
2021-03-05 PSAAS-2281 Containers are being opened even if an artifact submission fails

May 27, 2021 release 4.12.0

Date filed Issue number Description
2021-06-11 PSAAS-2126 REST API rest/artifact returns empty cef_type for defaults CEFs
2021-06-08 PSAAS-2081, PSAAS-1798, PSAAS-2242 Playbook action fails intermittently with error message"Failed to send request to Automation Broker."
2021-06-01 PSAAS-2028 Investigation - Artifacts dropdown list not closed after selection
2021-05-27 PSAAS-1985 Automation Broker does not support internal proxies.
2021-05-25 PSAAS-1947 Onboarding artifact with IP 60.163.90.8 leads to app error message
2021-05-25 PSAAS-1960 Automation Broker: Cannot handle very large downloads or POSTs
2021-05-20 PSAAS-1881 Action Broker action concurrency: asset concurrency limit changes are only applied when broker is restarted.
2021-05-20 PSAAS-1894 Investigation page: Action Widget sorting is not working
2021-05-14 PSAAS-1798, PSAAS-2226, PSAAS-2081 Playbook action fails with error message"Failed to send request to Automation Broker."
2021-05-07 PSAAS-1758 Playbook debug output doesn't print the playbook, repo, and user names on the first statement
2021-04-01 PSAAS-1240 SAML: Improve logging the message for why a user is not authorized
Last modified on 04 April, 2024
PREVIOUS
What's new in 		  NEXT
Fixed issues for

This documentation applies to the following versions of Splunk® SOAR (Cloud): current

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters