The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Fixed issues for
November 6, 2024 Release 6.3.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2024-11-06 | PSAAS-7499 | VPE: Playbook name field should be longer |
| 2024-10-17 | PSAAS-19917, PSAAS-20071 | Reports page drop down results in 500 Server Error |
| 2024-10-14 | PSAAS-19708 | Playbooks might remain in pending status |
| 2024-10-08 | PSAAS-18082 | VPE: Blocks invisible when using Safari Version 17.5 |
| 2024-09-30 | PSAAS-19362 | Placeholder values for custom indexes in the Forwarder Settings modal don't match the actual default indexes |
| 2024-09-30 | PSAAS-17189 | Playbook deletion is not logged in the audit trail |
September 12, 2024 Release 6.3.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2024-10-21 | PSAAS-17715 | VPE CF block resource warning not being removed upon reconfiguring |
| 2024-10-08 | PSAAS-19325 | Export of playbooks does not work if using the Optional "Path to Playbooks" is specified in source control |
| 2024-08-22 | PSAAS-19036 | About page shows "Splunk Version" and "Splunk Build", which are not accurate as Splunk no longer ships with SOAR |
| 2024-08-20 | PSAAS-18172 | VPE crashes with TypeError when opening a playbook |
| 2024-08-16 | PSAAS-14608 | Images are not visible in app documentation |
| 2024-08-07 | PSAAS-13255 | Deleting a container with 1000+ artifacts causes UWSGI to run out of memory. |
| 2024-07-31 | PSAAS-17869 | SAML auth denied due to duplicate key serial numbers |
| 2024-07-29 | PSAAS-18317 | Cascading deletion of Assets, Users, PlaybookRun, and App data when deleting a Container |
| 2024-07-18 | PSAAS-17198 | Unable to close containers receiving the error 'str' object has no attribute 'get' |
| 2024-07-15 | PSAAS-17997 | Playbook Listing page tabs show incorrect list, except "All" tab |
| 2024-06-27 | PSAAS-17135 | Investigation page: Playbook run tab is broken for playbook with empty inputs |
| 2024-06-20 | PSAAS-17498 | uwsgi lock is not released when credential package already exists |
| 2024-06-06 | PSAAS-16538 | Generated reports: Cannot sort on Generated column |
May 29, 2024 Release 6.2.2
| Date resolved | Issue number | Description |
|---|---|---|
| 2024-06-05 | PSAAS-17823 | Incident types not syncing between MC and SOAR |
| 2024-06-04 | PSAAS-12158 | User filtering is using first/last name to filter events instead of just username |
| 2024-05-28 | PSAAS-17857 | Update from source control failing due to playbook name with square braket and colon in its name |
| 2024-05-28 | PSAAS-17788 | "Failed to create indicator" error because indicator length is too long |
| 2024-05-28 | PSAAS-17799 | Automation Broker ver 6.2.2 container status shows unhealthy state |
| 2024-05-20 | PSAAS-17112, PSAAS-16933 | Container updates are not atomic |
| 2024-05-13 | PSAAS-17655 | Memory leak in handling of custom function results |
| 2024-05-08 | PSAAS-17560 | Playbook converter cannot convert playbooks with set_owner or add_note |
| 2024-05-06 | PSAAS-17559 | "0: command not found" error is printed to the console when running start_phantom.sh |
| 2024-04-09 | PSAAS-17194 | Password reset email has un-clickable URL |
| 2024-04-08 | PSAAS-14125 | Users without the "Administrator" role cannot delete an Automation Broker, even when given appropriate permissions. |
| 2024-02-20 | PSAAS-13579 | Password reset email does not prominently display the reset page URL. Need to update URL manually. |
March 28, 2024 Release 6.2.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2024-04-04 | PSAAS-12591 | VPE: Artifact labels in datapaths are not universally supported |
| 2024-03-28 | PSAAS-8541 | Unreadable characters sporadically appear in UI |
| 2024-03-26 | PSAAS-16962, PSAAS-16431 | Automation Broker action fails to cancel correctly |
| 2024-03-26 | PSAAS-16963, PSAAS-16431 | Automation Broker fails to escape null characters |
| 2024-03-11 | PSAAS-16529 | When navigating back from investigation page to the analyst queue, stale filters are selected |
| 2024-03-11 | PSAAS-16210 | VPE: "Reconfigure Invalid Datapath" warnings on blocks after upgrade |
| 2024-03-06 | PSAAS-16355 | VPE: Renamed blocks do not reflect changed names in End block |
| 2024-03-04 | PSAAS-15638 | Paginating REST APIs without sorting may give duplicate results across pages. Also affects phantom.get_tasks() and phantom.get_notes() playbook APIs, when containers have >10 tasks or >10 notes, respectively |
| 2024-02-29 | PSAAS-16368 | Copying playbook from remote repository to local repository fails |
| 2024-02-27 | PSAAS-13913 | VPE: After clicking Discard Changes button, blocks show error "Reconfigure Invalid Data Path" |
| 2024-02-22 | PSAAS-15916 | Under some conditions, Splunk SOAR's global search can quickly consume huge amounts of memory in uwsgi processes |
| 2024-02-22 | PSAAS-16357 | Playbook Converter: Datapaths not present in modern datapath picker for custom function and playbook blocks |
| 2024-02-22 | PSAAS-16117 | Upgraded instance throws error when creating local git repo |
| 2024-02-08 | PSAAS-16157 | Upgrade to 6.2.0 failed with error "Failed to move /opt/phantom/data/db to /opt/phantom/data/db.old" when DB is on its own disk partition |
| 2024-02-05 | PSAAS-15256 | Inactivity timeout logs the user out while working in the VPE |
| 2024-02-05 | PSAAS-16122 | Saving playbooks to a local repo fails with 'Push master failed: (branch is currently checked out)' |
| 2024-02-01 | PSAAS-15821 | Global search not working for custom fields |
| 2024-02-01 | PSAAS-16049 | Playbook converter: Asset name is incorrect in the converted playbook |
| 2024-01-31 | PSAAS-8919 | VPE: Line after filter block loses label when doubled then removed |
| 2024-01-31 | PSAAS-15694 | Indicators page shows empty table for non-admin users |
| 2024-01-31 | PSAAS-15610 | Widget visibility is not saved via "manage widgets" |
| 2024-01-31 | PSAAS-14693, PSAAS-16192 | VPE: MC block - Actions with optional query parameters not working |
| 2024-01-30 | PSAAS-14869 | Only draft app shows as runnable when searching to run apps "by app" |
| 2024-01-30 | PSAAS-15201 | Password Vault: "Assets with enabled password manager" table can lead to Apps page without an asset selected |
| 2024-01-30 | PSAAS-15709 | Playbook API: phantom.format throws error when a value is not found on the datapath |
| 2024-01-30 | PSAAS-16112 | Playbook Converter: Case sensitivity and variable differences are not handled properly |
| 2024-01-29 | PSAAS-15951 | spawn.log is not working after upgrading to SOAR version 6.1.1 |
| 2024-01-29 | PSAAS-16089 | Missing notification for inactivity timeout |
| 2024-01-29 | PSAAS-15392 | Playbook Converter: Synchronous playbook fails to run for converted playbooks |
| 2024-01-29 | PSAAS-16069 | SOAR doesn't seem to update to inactive when broker_shutdown is called |
| 2024-01-29 | PSAAS-15695 | JSON viewer for input playbooks - analyst view- has clickable URLs |
| 2024-01-22 | PSAAS-15648 | MC SOAR customers are not able to modify the data types of the MC Forwarder Group |
| 2024-01-22 | PSAAS-16087 | MC Setup: SOAR Repo roles failed to be created |
| 2024-01-17 | PSAAS-15957 | Investigation page: Activity tab doesn't show playbook name. Shows "..." |
| 2024-01-11 | PSAAS-15100 | PB Converter: Asset Mapper modal is not shown in the converted playbook |
| 2024-01-09 | PSAAS-15959 | ForwarderGroup TCP token can be accidentally cleaned up if forwarder group is inactive |
| 2024-01-03 | PSAAS-15612 | Changing multiple incident fields in Mission Control results in duplicate SOAR update messages |
| 2023-12-20 | PSAAS-15685 | Naming a forwarder group "splunk" breaks forwarding |
| 2023-12-19 | PSAAS-13496 | App Editor: Setting default app action booleans to 'false' does not work. |
| 2023-12-13 | PSAAS-8939 | VPE: Custom function failure logging is not in red font |
| 2023-12-13 | PSAAS-14550 | User unable to bulk edit/close the events due to missing unrelated required tag |
| 2023-12-13 | PSAAS-15199 | If the CyberArk instance is down and an action is run, the response message is not clear |
| 2023-12-12 | PSAAS-15528, PSAAS-13668 | Home Page: Open event widget has overlapping characters for SLA and Severity |
| 2023-12-12 | PSAAS-9149 | Issues with environment variables when "Secret" is checked |
| 2023-12-12 | PSAAS-15338 | The Repo Permissions in the user modal does not show permissions |
| 2023-12-12 | PSAAS-13362 | Playbook Run History: Need to add 'Pending' to Status column filter |
| 2023-12-11 | PSAAS-15543 | Test connectivity for asset might result in "failed to send" and HTTP 500 "internal server" error for POST to /rest/asset/{id} |
| 2023-07-10 | PSAAS-13995 | An artifact CEF field not editable when created using REST API call if value is 0 |
November 30, 2023 Release 6.2.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-11-29 | PSAAS-12593 | VPE utility block configure does not get refreshed. |
| 2023-11-29 | PSAAS-7956 | VPE: Block with name of "artifacts" confuses generated code resulting in incorrect and unexpected output |
| 2023-11-28 | PSAAS-15530, PSAAS-15538 | SOAR incidents no longer updated from MC after a Note is added |
| 2023-10-30 | PSAAS-14450 | Automation Broker stopped responding. All actions failed due to Failed to send request to Automation Broker error |
| 2023-10-26 | PSAAS-15183 | SOAR UI renders permissions incorrectly for users who have many roles on the roles and permissions page |
| 2023-10-25 | PSAAS-14969 | Update from source control of external repo to pull a new Custom Function also creates a new playbook |
| 2023-10-25 | PSAAS-14627 | VPE: Code from one utility block might be copied into another utility block in the same playbook |
| 2023-10-25 | PSAAS-15123 | Assets table in Password Vault, sorting after search does not show all the assets |
| 2023-10-16 | PSAAS-15001 | Prevent "set summary fields" action from overwriting the data field in a container |
| 2023-10-05 | PSAAS-14864 | Vault items marked as evidence give 404 error OR download wrong file when trying to download |
| 2023-09-12 | PSAAS-12349 | Mission Control: Splunk users without an email address cannot change their user settings in SOAR |
| 2023-09-12 | PSAAS-13358 | The `server` URL provided via the UI with an automation user's `ph-auth-token` can be inconsistent |
| 2023-09-12 | PSAAS-13546 | App Viewer attempts to load but crashes on lower permission user |
| 2023-09-11 | PSAAS-14534 | SOAR Installer can appear to hang if the database is not running. |
| 2023-09-05 | PSAAS-14116 | App Editor Console Output has black fonts in dark theme |
Versions 6.0.0 - 6.1.1
September 6, 2023 Release 6.1.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-08-25 | PSAAS-13177 | VPE: Playbook input elements in Configure panel is not shown due to repo ID mismatch |
| 2023-08-24 | PSAAS-13482 | All text in h4 for prompts is by default capitalized in the table on the notification page |
| 2023-08-24 | PSAAS-14497, PSAAS-14560 | VPE: Reversion fails for playbooks with periods in their names |
| 2023-08-23 | PSAAS-14461 | Playbooks not running on container. psycopg2.errors.UntranslatableCharacter is observed in logs. |
| 2023-08-22 | PSAAS-14440 | Cannot delete all custom fields from UI |
| 2023-08-21 | PSAAS-13481 | Prompt status shows as 'answered' even if it was cancelled |
| 2023-08-16 | PSAAS-13723 | Playbooks Listing Page: Slow to load when there are many playbook runs record |
| 2023-08-15 | PSAAS-12773 | Automation Broker: phantom_broker_proxy terminates websocket connections |
| 2023-08-14 | PSAAS-13345 | Uninformative error when creating action with invalid app format |
| 2023-08-02 | PSAAS-14102 | The original State file is replicated with app dir's state file |
| 2023-07-31 | PSAAS-14172, PSAAS-14173 | The delete_containers.pyc script omitted from SOAR 6.1.0 builds. |
| 2023-07-25 | PSAAS-13990 | : Test connectivity over Automation Broker is not working after setting the public key in ssh repository |
| 2023-07-24 | PSAAS-13971 | VPE: opening playbook hangs on "loading playbook editor"; console shows error messages "TypeError: Cannot destructure property '{property}' of '{value}' as it is undefined." |
| 2023-07-21 | PSAAS-13813 | encryption_helper.encrypt fails when encrypting data larger than 4096 bytes |
| 2023-07-13 | PSAAS-12772 | Automation Broker sometimes failed to reconnect |
| 2023-07-11 | PSAAS-13898 | Splunk SOAR's cron jobs generate output, which fills up mail boxes over time |
July 11, 2023 Release 6.1.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-06-09 | PSAAS-11190 | VPE: Block Names with Container - A block name with "container" cannot share its results in other blocks in the Visual Editor |
| 2023-06-09 | PSAAS-12976 | VPE: Manually selecting an asset deletes block configuration |
| 2023-06-08 | PSAAS-13503 | When a user without system_settings view permission switches tabs from the SOAR homepage, the SOAR UI and apps become unresponsive. |
| 2023-06-06 | PSAAS-12782 | VPE: phantom.collect2 fails if using a filter block that contains an action name |
| 2023-06-02 | PSAAS-13156, PSAAS-12705 | VPE: Condition blocks treat "False" and "True" as strings, not Boolean values |
| 2023-06-01 | PSAAS-13154 | VPE: When opening playbooks, 'Invalid Resource' appears incorrectly on some blocks |
| 2023-05-19 | PSAAS-12331 | VPE: Naming blocks the same for utility block causes the blocks to sync |
| 2023-05-02 | PSAAS-12445 | Nginx '502 Bad Gateway' after submitting a large batch of events |
| 2023-05-02 | PSAAS-12198 | App action links within app documentation do not work |
| 2023-04-29 | PSAAS-13084 | Some SOAR connectors fail to install due to missing modules - import error |
June 2023 Release 6.0.1 Update
Cloud deployments have been patched and are not affected by the token expiration issue.
May 17, 2023 Release 6.0.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-09-21 | PSAAS-12928 | Welcome email for newly provisioned SOAR cloud stack references incorrect admin user |
| 2023-06-08 | PSAAS-13503 | When a user without system_settings view permission switches tabs from the SOAR homepage, the SOAR UI and apps become unresponsive. |
| 2023-05-18 | PSAAS-10127 | Playbooks using Threat Grid or urlscan.io app hang on the detonation action |
| 2023-04-10 | PSAAS-12370 | VPE: Downstream datapath variable values are replaced with variable name in various block types after upgrade |
| 2023-04-07 | PSAAS-11587 | A successful completion of called playbook in Synchronous mode, over-writes failure result in calling playbook |
| 2023-04-07 | PSAAS-12333 | Playbooks that open with smart block context warnings will disable the debugger and display 'Discard Changes' button |
| 2023-04-05 | PSAAS-12592 | VPE: Screen goes blank when loading playbook in v6.0 worked in v5.5 |
| 2023-04-05 | PSAAS-11960 | VPE: "Refresh Event Data" in Utility block removes some of the original container information |
| 2023-04-04 | PSAAS-12839 | GitRepos Installer step can fail on upgrades if the community repo has been disabled and duplicate playbooks exist in the db. |
| 2023-04-03 | PSAAS-12766 | Cannot Subscribe to more than one scheduled report in UI |
| 2023-03-30 | PSAAS-12147 | System health charts truncate values |
| 2023-03-30 | PSAAS-11509 | Third-party license information is included in documentation, but not in the product UI |
| 2023-03-29 | PSAAS-12842 | When using an internal IdP for SAML2 auth, an error from incorrectly parsed XML prevents users from logging in |
| 2023-03-28 | PSAAS-12369 | Logrotate fails because of syntax error in the config file |
| 2023-03-28 | PSAAS-12767 | App install with Chrome browser: Browser crashes when installing a TAR or TGZ file |
| 2023-03-27 | PSAAS-12311, PSAAS-12328 | Prompt block icon disappear after creating more than one empty questions |
| 2023-03-27 | PSAAS-12307 | VPE: Playbook Block: After multi-selecting inputs, deleting all selections and adding new selection has a comma prepended to datapath |
| 2023-03-27 | PSAAS-12328, PSAAS-12311 | VPE: End block icon disappear after creating more than one empty questions |
| 2023-03-22 | PSAAS-11797 | App actions fail due to unescaped null characters (PSAAS-10127) |
| 2023-03-21 | PSAAS-12284 | Playbook input variables are marked as invalid within an input playbook |
| 2023-03-21 | PSAAS-11327, PSAAS-9665 | VPE: Debugger hangs when running playbook; It goes blank and needs refresh |
| 2023-03-21 | PSAAS-12155 | Adding multiple inputs to a previously saved custom function - not in alphabetical order - invalidates custom function. |
| 2023-03-21 | PSAAS-12470 | custom app install fails with "Multiple app directories detected." after upgrading from 5.5.0 to 6.0.0 |
| 2023-03-20 | PSAAS-11581 | PlaybookRunEx::UpdateStatus fails to update when playbook run is very old. |
| 2023-02-27 | PSAAS-11472 | test_connectivity action fails with an asset using hashicorp vault credential manager on app editor |
| 2023-02-21 | PSAAS-11001 | Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition |
| 2023-02-06 | PSAAS-12004 | Playbook processing stops when Python runners time out and not get restarted |
| 2023-01-30 | PSAAS-11802 | Artifact save invokes indicator extraction when indicator feature is disabled. |
| 2023-01-25 | PSAAS-10582 | UI crash: opening container with a HUD CARD using a Custom Field and a list value leads to a blank page. |
| 2022-12-21 | PSAAS-11389 | Git app: Action git commit fails |
| 2022-11-29 | PSAAS-10817 | Bulk edit of Python 2 playbook properties is not blocked |
Fixed issues - Advance release
Issues fixed between the limited availability advance release and this general availability release of Splunk SOAR (Cloud) 6.0.1.
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-05-08 | PSAAS-13260, PAPP-30346 | Unicode escape sequence affected apps |
| 2023-05-09 | PSAAS-13272, SOARHELP-1912, SOARHELP-1678 | New asset parameters with default values are not set on app upgrade |
| 2023-05-10 | PSAAS-13028, PSAAS-13084, SOARHELP-1909 | Import error affects some apps and packages |
| 2023-05-10 | PSAAS-13273, SOARHELP-1917 | DecideD frequently restarted |
February 22, 2023 Release 6.0.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-02-21 | PSAAS-11648 | Analyst Queue: When applying filters for owner for cases and events, the metrics at the top of the case screen do not change (containers are filtered) |
| 2023-02-15 | PSAAS-12280 | VPE: Playbook block inputs: text is deleted/added while user types |
| 2023-02-09 | PSAAS-11841 | Upgrading a SOAR instance to 5.5 does not change the community repo branch to 5.5 |
| 2023-02-08 | PSAAS-11979 | VPE: clicking on a block does not bring up the sidebar for editing conditions |
| 2023-02-03 | PSAAS-11650, PSAAS-12122 | VPE : Existing input playbook blocks are not configurable to change the input source |
| 2023-02-01 | PSAAS-11514 | VPE smart block context not taking into account custom datapaths |
| 2023-01-31 | PSAAS-11458 | Cleaning up containers via Data Retention causing excessive disk space usage |
| 2023-01-31 | PSAAS-11997 | Questions regarding python pandas/tabulate library in SOAR 5.5 - Pandas requires version '0.8.3' or newer of 'tabulate' (version '0.8.1' currently installed) |
| 2023-01-30 | PSAAS-11874 | Reindexing 'asset' index does not work on Elastic Search |
| 2023-01-30 | PSAAS-9891 | Indicators are visible with labels that roles do not allow |
| 2023-01-27 | PSAAS-5408 | /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags |
| 2023-01-27 | PSAAS-11242 | VPE: After correct reconfiguration, "invalid resource" warning persists within subplaybook block |
| 2023-01-20 | PSAAS-11004, PSAAS-11658 | VPE: Values entered into custom function/Utility input arguments are deleted or modified |
| 2023-01-17 | PSAAS-11068 | Port forward from NRI port to 443 doesn't work on local machine. |
| 2023-01-13 | PSAAS-9054 | VPE : Playbooks fail to save: No name 'rules' in module 'phantom' |
| 2023-01-10 | PSAAS-11328 | VPE Empty Variables with inconsistent use of quotes |
| 2023-01-10 | PSAAS-11423 | Custom Function Editor: Not saving data type change |
| 2023-01-10 | PSAAS-11694 | VPE/prompt: "Could not find 'undefined' in users or roles" during playbook runs after upgrading from 5.4.0 and editing/saving the playbook |
| 2023-01-09 | PSAAS-11057 | Ingestd Daemon can hang during poll now in rare scenarios. |
| 2023-01-04 | PSAAS-11401 | Automation Broker generates a high volume of extraneous audit log records. |
| 2022-12-21 | PSAAS-11389 | Git app: Action git commit fails |
| 2022-12-13 | PSAAS-10503 | Decided cancels running playbooks on ALL nodes after restarting |
| 2022-12-13 | PSAAS-11127 | Users with role "OnPrem Broker" incorrectly counted towards seat-based license |
| 2022-12-09 | PSAAS-10997 | Playbook decision block convert boolean strings to boolean values |
| 2022-12-06 | PSAAS-10703 | Default workbook is reset on upgrade if the original default has been removed |
| 2022-11-29 | PSAAS-11181 | Fix page crash on load for blocks using external resources |
| 2022-11-23 | PSAAS-11121 | AppUpdate should continue to work with custom apps that have invalid versions |
Versions 5.0.0 - 5.5.0
January 4, 2023 release 5.5.0 update
This is an update to the 5.5.0 release.
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-01-04 | PSAAS-11500 | VPE block outputs/datapaths not available downstream on playbook load |
Refer to the table of Fixed issues for the December 14 release for the complete list of fixed issues for release 5.5.0.
December 14, 2022 release 5.5.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-12-08 | PSAAS-11123 | App asset servers configured to use TLS 1.2 version or lower will not work with SOAR on RHEL 8 due to OpenSSL hardening |
| 2022-12-06 | PSAAS-10703 | default workbook is reset on upgrade if the original default has been removed |
| 2022-11-29 | PSAAS-10664 | Analyst Queue: When applying filters for owner for cases and events, the metrics at the top of the case screen do not change |
| 2022-11-29 | PSAAS-10965 | Upgrades to 5.4.0 are missing user_broker_version key value |
| 2022-11-28 | PSAAS-10454 | UI error when navigating to case evidence tab caused by linked container that was removed by retention. |
| 2022-11-28 | PSAAS-11077 | Cloud : Remote search indexing : One event per day is missed |
| 2022-11-28 | PSAAS-9731 | Splunk app 'run query' action runs infinitely |
| 2022-11-28 | PSAAS-11080 | dhparams is missing when there is no install or upgrade |
| 2022-11-23 | PSAAS-11121 | AppUpdate should continue to work with custom apps that have invalid versions |
| 2022-11-15 | PSAAS-11049 | Search setting failing on test connection. |
| 2022-11-01 | PSAAS-10107 | Status of Case is missing from Report |
| 2022-11-01 | PSAAS-8933 | JIT does not work when Automation Broker is configured which should be disabled |
| 2022-10-26 | PSAAS-9107 | App Install : Fails due to NFS lock in App directory |
| 2022-10-20 | PSAAS-10205 | Incorrect notification when connecting to Splunkbase |
October 27, 2022 release 5.4.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2023-08-01 | PSAAS-13312 | regression: app editor: "Error in 'python3': free(): invalid pointer:" when running test connectivity; similar code does not throw error when run from command line via phenv |
| 2022-11-29 | PSAAS-10965 | AB Auto Update does not work on upgraded stacks to 5.4.0 |
| 2022-11-11 | PSAAS-11118, PSAAS-8901 | VPE 2: Adding a parameter to an action block deletes another parameter. |
| 2022-10-19 | PSAAS-9898 | Add "Learn More" link to Playbook Bulk Edit Modal Results |
| 2022-10-19 | PSAAS-9971 | BMC Remedy app notification email: Escape character breaks email |
| 2022-10-17 | PSAAS-9665, PSAAS-11327 | VPE: SOAR UI hangs in VPE debug and UI will go blank and need refresh |
| 2022-10-14 | PSAAS-10263 | "500 Server Error" when downloading vault file with name containing a line feed |
| 2022-10-14 | PSAAS-10287 | Interval/Schedule ingestion settings cannot be changed |
| 2022-10-13 | PSAAS-10250 | Automation Broker exhausts OS ulimits and stops processing actions |
| 2022-10-12 | PSAAS-10421 | Massive volume of PhUser last_login updates causing DB bottlenecks |
| 2022-10-05 | PSAAS-8607 | JSON Viewer: Action result data truncated in UI with no indication there is more |
| 2022-10-04 | PSAAS-10265 | NMAP App not compatible with Automation Broker |
| 2022-09-19 | PSAAS-10239 | When 2 activated LDAP configurations are present, login fails with the second LDAP configuration |
| 2022-09-16 | PSAAS-9678 | app_interface.log can grow to large size because it does not roll over and is in debug |
September 28, 2022 release 5.3.5
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-09-19 | PSAAS-9413 | Generating container report gets timeout with high CPU utilization or creating 9000+ page long report |
| 2022-09-19 | PSAAS-9793 | Custom field message has broken link to documentation |
| 2022-09-19 | PSAAS-9910 | Bulk Edit of Playbooks allow setting playbooks that are in draft mode to active |
| 2022-09-14 | PSAAS-9319 | Webserver log level setting in admin UI is not respected |
| 2022-09-14 | PSAAS-10158 | Upgrades may fail on PrepSystem step due to a cp failure with "Text File Busy" |
| 2022-08-30 | PSAAS-9935 | When running soar-prepare-system, the prompt for setting the Splunk SOAR user's password is overwritten by a progress spinner |
August 31, 2022 release 5.3.4
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-08-25 | PSAAS-9968 | Enabling Duo 2FA makes it impossible for non-automation users to authenticate to the REST API, effectively breaking UI functionality |
| 2022-08-23 | PSAAS-9044 | Improve performance of search indexing for SOAR data |
| 2022-08-23 | PSAAS-9798 | Extremely large floating point numbers could not be returned from actions (affecting MS Graph for SharePoint) |
| 2022-08-19 | PSAAS-9718 | Visual Playbook Editor: Phantom.completed callback missing and causing the join block not waiting for upstream blocks to complete |
| 2022-08-18 | PSAAS-9663 | SOAR does not reserve enough memory for critical processes when user playbook code leaks enough memory |
| 2022-08-17 | PSAAS-9687 | Logging around the Splunk Forwarder is insufficient (add-es-index-stdout.log) |
| 2022-08-16 | PSAAS-7020 | Investigation page: permitted_users_roles calls DB excessively causing poor performance |
| 2022-08-11 | PSAAS-9681 | Some apps action failed to run on ver 5.3.3 due to Json payload data=None |
| 2022-08-10 | PSAAS-9316 | Visual Playbook Editor: A 'false' value in artifact CEF is not evaluated correctly in decision and filter blocks |
July 28, 2022 release 5.3.3
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-07-25 | PSAAS-8274 | Multiple LDAP providers cannot be configured due to incorrect exception handling |
| 2022-07-22 | PSAAS-9230 | Workflowd daemon crashes if approvals are missing asset ID |
| 2022-07-21 | PSAAS-8595 | indicator_artifact endpoint with indicator_value parameter shows unexpected results for modified indicators |
| 2022-07-19 | PSAAS-8689 | Postgres is listed on the system health page with status "unknown" when a remote DB is configured |
| 2022-07-12 | PSAAS-4107 | VPE 2: Prompt does not allow automation user and yet is selectable |
| 2022-06-29 | PSAAS-6894 | Apps: Clone App modal has text misalignment/wrapping issue with long asset name |
| 2022-06-28 | PSAAS-3819 | VPE 2: Correct documentation path |
| 2022-06-28 | PSAAS-8743 | VPE 2: Playbook block for subplaybook is missing playbook descriptions |
| 2022-06-24 | PSAAS-9037 | NGINX and PGBouncer logs aren't set to rotate in unprivileged instances |
| 2022-06-24 | PSAAS-8615 | Search for numbers only does not work |
| 2022-06-23 | PSAAS-8954 | Running 'Update All' on Apps appears to cause ownership / permissions problems |
| 2022-06-13 | PSAAS-8792 | phenv db_maintenance cannot run data retention for containers due to an AttributeError |
| 2022-05-19 | PSAAS-8686 | Adding attachments to a note raise error "Upload has failed " |
| 2022-05-17 | PSAAS-4193 | Prompt block Response Time can be negative number |
| 2022-05-16 | PSAAS-7161 | setup_warm_standby - Error due to busy mount point |
| 2022-05-03 | PSAAS-8691 | Data retention management command is missing job schedule info |
| 2022-05-03 | PSAAS-8569 | 5.2.1 -> 5.3.x upgrades fail if custom pip packages have been installed and the system cannot directly reach pypi.org without a proxy |
| 2022-05-03 | PSAAS-6822 | VPE 2: Custom block name actual character limit and limit error message don't match |
| 2022-04-28 | PSAAS-8132 | Saving an event without change increases/decreases event SLA |
| 2022-04-19 | PSAAS-5451 | Updating container's severity from playbook doesn't update SLA |
| 2022-04-14 | PSAAS-8499 | Upgrade from 5.2.1 to 5.3.x fails with error "Failed to bootstrap playbook repos" |
| 2022-04-04 | PSAAS-5303 | When multi-tenancy is enabled, Home dashboard shows the filter buttons in 2 lines |
| 2022-03-22 | PSAAS-7738 | VPE 2: Action block with built-in format causes overlapping fields with parameters and becomes uneditable |
| 2022-03-15 | PSAAS-7300 | Investigation page Workbook pane: "run playbook" dialog box incorrectly placed upon clicking 2nd and subsequent playbooks to launch |
June 22, 2022 release 5.3.2
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-05-11 | PSAAS-7633 | C++ log truncation can result in bad json for very long messages |
| 2022-05-11 | PSAAS-8617 | Ingestion failures |
| 2022-05-11 | PSAAS-8830 | Excessive DB usage during asset or ingestion settings updates. |
April 11, 2022 release 5.3.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-04-09 | PSAAS-8551 | Any non-admin user cannot view the playbook listing due to a failure in API permission checks when using "exclude" parameters |
| 2022-04-05 | PSAAS-7399 | Ingestion stalls when assets are modified while ingesting |
| 2022-03-22 | PSAAS-5764 | Apps page: After splunkbase login, available updates are replaced by newer list of apps. |
| 2022-03-22 | PSAAS-7593 | Multiple indicators for same value |
| 2022-03-17 | PSAAS-7737 | VPE 2.0 - true and True produce different types in code generation |
| 2022-03-14 | PSAAS-7694 | Cannot install App using RPM in new SOAR installers |
| 2022-03-14 | PSAAS-7847 | VPE 2.0 - Upgrade JSON schema version and move asset locating logic to a new migration |
| 2022-03-11 | PSAAS-7482 | VPE 2.0 - Capital letter in playbook name breaks code generation |
| 2022-03-11 | PSAAS-7978 | Rest API response is different when using _filter and _exclude |
| 2022 | PSAAS-5841 | VPE 2.0 - Playbook history shows current time instead of commit time |
| 2022-03-08 | PSAAS-7815 | Automation Broker does not rotate log files in splunk_data/log. |
| 2022-03-08 | PSAAS-7650 | Automation Broker not applying HTTPS_PROXY configuration correctly. |
| 2022-03-08 | PSAAS-7215 | Prompts are not canceled/disabled under the Approvals tab after Playbooks are canceled by the user |
| 2022-03-02 | PSAAS-7574 | VPE 2.0: Imported 5.0 playbook does not recognize the asset used and asset dropdown is empty |
| 2022-02-25 | PSAAS-7494 | VPE 2.0 - Importing playbook created in previous releases deletes action parameters |
| 2022-02-25 | PSAAS-7568 | VPE 2.0: "if" statement in action block code is missing in version 5.2.1 compared to version 5.1.0 |
| 2022-02-24 | PSAAS-7649 | uwsgi stops handling requests with SIGNAL QUEUE IS FULL error |
| 2022-02-22 | PSAAS-7495 | Classic VPE - Asset import wizard no longer shows valid asset |
| 2022-02-22 | PSAAS-6604 | Apps Updates popup modal missing release notes link |
| 2022-02-14 | PSAAS-6709 | Rest API /rest/search query categories not filtering properly when container is specified. |
| 2022-02-14 | PSAAS-6918 | Python Playbook API block "add note" is missing data path option for note_title parameter |
| 2022-01-31 | PSAAS-5606, PSAAS-5597 | Editing existing actions in the app editor does not properly populate default parameters in the modal |
| 2022-01-31 | PSAAS-5597, PSAAS-5592, PSAAS-5606 | App Wizard's editor: Misconfiguring a new action in the "Add Action" modal may cause subsequent usages of the modal to generate TypeErrors. |
| 2022-01-24 | PSAAS-7028 | VPE 2.0 - UI issue causing dot separation in playbooks which worsens over time |
January 26, 2022 release 5.2.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2022-01-22 | PSAAS-7132 | Triggering playbook runs from the UI can hang the webserver if only one worker is available |
| 2022-01-18 | PSAAS-7173 | Analyst Queue: Event filtering only allows one user at a time |
| 2022-01-15 | PSAAS-6603 | IDP-initiated SAML authentication succeeds, but presents an error to the user |
| 2022-01-11 | PSAAS-7007 | Automation does not begin on closed events cloned from artifact being added to them |
| 2022-01-06 | PSAAS-3949 | VPE 2.0 - After dragging an arrow from the start block in Firefox, there's no pop-up to create a new block. |
| 2022-01-06 | PSAAS-6946 | VPE 2.0 - format block as_list does not work with playbook inputs |
| 2022-01-05 | PSAAS-6027 | Investigations: Artifacts having a cef field named "id" do not display artifact ID number |
| 2022-01-05 | PSAAS-3881 | VPE 2.0 - Visual errors in Safari |
| 2021-12-22 | PSAAS-3807 | VPE 2.0 - Missing warning outline on a block when empty required fields |
| 2021-12-22 | PSAAS-6899 | VPE - Boolean parameter in action block does not display as 'set'(checked) for a default value of 'true' in JSON |
| 2021-12-22 | PSAAS-3687 | VPE 2.0 - HTTP app configuration missing required argument in execution |
| 2021-12-20 | PSAAS-5572 | In the App Wizard's editor, the "Draft Apps" listing does not accurately report the number of supported actions. |
| 2021-12-14 | PSAAS-6440 | App Wizard UI does not fully display when using the light UI theme. |
| 2021-12-14 | PSAAS-6469 | VPE 2.0: Accessing formatted data as a list no longer generates "for" loop |
| 2021-12-14 | PSAAS-3824 | VPE 2.0 - Icon on Audit trails is open link, it should be a download |
| 2021-12-09 | PSAAS-3964 | VPE 2.0 - Filtered artifacts datapaths do not add artifact id to action parameter context |
| 2021-12-09 | PSAAS-6865 | Playbook Listing page crashes in Chrome & Edge browsers when filtering |
| 2021-10-26 | PSAAS-5566 | UI won't update information when navigating events |
| 2021-10-18 | PSAAS-5722 | Child Playbook failed and its parent gets hung |
November 17, 2021 release 5.1.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2021-11-29 | PSAAS-2681 | Playbook action hangs for over 30m then fails on broker |
| 2021-11-03 | PSAAS-6036 | app_interface process causing uwsgi processes to hang indefinitely |
| 2021-10-22 | PSAAS-1801 | Note title and description are cleared when uploading a new file or image |
| 2021-10-22 | PSAAS-6030 | Task Note: Cannot add a new file when editing a task note |
| 2021-10-19 | PSAAS-4075 | VPE 2.0: Imported playbook does not show block configuration in visual editor, but the Python code is correct. |
| 2021-10-18 | PSAAS-3343 | Some actions fail with "failed to send request to AB" on AB 64172 |
| 2021-10-18 | PSAAS-5904 | In SAML, OIDC and LDAP Auth, group delimiter was not applied if group list was provided by the IDP as a comma separated string |
| 2021-10-15 | PSAAS-1816, PSAAS-5748, PSAAS-5763 | Evidence is not added when adding an action run to a case and mark as an evidence |
| 2021-10-12 | PSAAS-5542 | Issue with allowing roles to pass permission checks in unauthorized areas when performing reporting operations |
| 2021-10-12 | PSAAS-2524 | Custom List's audit records can consume lots of disk space, resulting in the audit table being huge. |
| 2021-10-11 | PSAAS-2378 | Activity timeout does not take activity into account |
| 2021-10-08 | PSAAS-5573, PSAAS-6581 | Investigation page: Related Events modal has Permission Error |
| 2021-10-07 | PSAAS-5305 | Playbook API: phantom.condition excessively slow on large action_results |
| 2021-10-05 | PSAAS-3375 | Garbage string printed for client id in AB logs during unregistration |
| 2021-10-04 | PSAAS-3230 | Resolution to Duplicate Event Replicating Closed event without adding new artifact |
| 2021-10-01 | PSAAS-2956 | Classic VPE: Action block does not always show available assets |
| 2021-09-30 | PSAAS-2292, PPS-25634 | Ensure that monthly releases' build version number is considered when offering app updates (ie 4.9.20000 vs 4.9.32000). |
| 2021-09-29 | PSAAS-1240 | SAML: Improve logging the message for why a user is not authorized |
| 2021-09-29 | PSAAS-2591 | Asset Proxy Settings: Previously configured HTTP or HTTPS Proxy not working as intended |
| 2021-09-28 | PSAAS-3481 | In Investigation page LDAP query displayed blurring result with big json |
| 2021-09-27 | PSAAS-2548 | Add related_category and remove tenant_info from ActionRun's deletion audit records |
| 2021-09-16 | PSAAS-3564 | Automation Broker: Unable to pair broker: brokerd caught in some endless loop preventing pairing |
| 2021-09-16 | PSAAS-3363 | Spawn log getting sent to docker console |
| 2021-09-14 | PSAAS-3452 | Cannot login via SAML2 |
| 2021-09-13 | PSAAS-3647 | VPE 2: Console error when loading |
| 2021-09-09 | PSAAS-2669 | Classic VPE: The Information link in the Template section of the Format block setting goes to the wrong place. |
| 2021-09-08 | PSAAS-3817 | VPE 2.0: Datapath picker won't let a non-leaf to be selected as a datapath |
| 2021-09-08 | PSAAS-3913 | VPE 2.0: Inconsistent spacing error. Tabs are not converted to spaces |
| 2021-09-07 | PSAAS-3231 | Notes markdown formatting being lost when event is promoted to a case |
| 2021-09-07 | PSAAS-3206 | Hitting 403 denied when trying to delete event Aggregation rule as user |
| 2021-09-03 | PSAAS-4012 | VPE 2.0: Cancelling change to playbook custom code can lead to duplicated custom code |
| 2021-09-03 | PSAAS-3308 | Last access not updated for automation user account access via REST API |
| 2021-09-03 | PSAAS-1415 | Downloading recent logs also downloaded old logs |
| 2021-09-01 | PSAAS-2673 | Uncaught exceptions in action blocks cause Phantom API authentication failures in on_finish block |
| 2021-08-31 | PSAAS-2558 | Approval - two different status after stopping approval process |
| 2021-08-31 | PSAAS-3311 | VPE - Classic editor throws uncaught reference. Clear cache and refresh to fix. |
| 2021-08-30 | PSAAS-3289 | Can't Delete Value from Org Id/Set Domain for Thycotic password vault |
| 2021-08-27 | PSAAS-2280 | format block/phantom.format() unexpectedly transform falsey input values to None |
| 2021-08-25 | PSAAS-3283 | Automation Broker: Unable to pair broker using the UI ("Failed to get proxy keys for pairing") |
| 2021-08-25 | PSAAS-3273 | Automation Broker failed to pair 2 out of 3 times due to token error. |
| 2021-08-24 | PSAAS-2782 | Unable to rotate encryption keys in the Automation Broker |
| 2021-08-23 | PSAAS-2781 | Broker sometimes fail to pair with Cloud SOAR instance |
| 2021-08-20 | PSAAS-3229 | Indicator View Search Filter Text Entry Cause Screen to Blank |
August 24, 2021 release 5.0
| Date resolved | Issue number | Description |
|---|---|---|
| 2021-10-05 | PSAAS-2242, PSAAS-2081 | Playbook runs fail intermittently with error "Error starting spawn: Timed out waiting for connector to bind back on port!" |
| 2021-09-08 | PSAAS-3006 | Data type is not displayed correctly when adding a CEF with multiple data types using the REST API |
| 2021-08-17 | PSAAS-2796 | Case Fields not updating upon label change |
| 2021-08-13 | PSAAS-1894 | Investigation page: Action Widget sorting is not working |
| 2021-08-09 | PSAAS-2795 | BaseConnector save_progress messages not showing up in Playbook Debugger |
| 2021-08-03 | PSAAS-2056, PSAAS-2157 | Home Page: Uses pull-down list populated with multiple duplicate names because it includes deleted users |
| 2021-07-28 | PSAAS-2509 | Playbook: Filtering an IP address against a value with a "/" fails |
| 2021-07-28 | PSAAS-2081, PSAAS-1798, PSAAS-2242 | Playbook action fails intermittently with error message"Failed to send request to Automation Broker." |
| 2021-07-28 | PSAAS-2226, PSAAS-1798 | Playbook action fails with "Timed out waiting for connector to bind back on port!" during performance longevity test |
| 2021-07-22 | PSAAS-2373 | Exception (AttributeError: 'bool' object has no attribute 'lower') raised when running make_cluster_node.pyc with a response.json file |
| 2021-07-21 | PSAAS-1726 | Action Broker not working in some environments without --net=host. |
| 2021-07-21 | PSAAS-2597, PSAAS-2689 | Playbook Editor: Error returns a JSON block instead of a formatted error message. |
| 2021-07-19 | PSAAS-2281 | Containers are being opened even if an artifact submission fails |
| 2021-06-17 | PSAAS-2054 | VPE: Naming block name "Summary" makes Decision/Filter block throws error |
| 2021-06-03 | PSAAS-1752 | vSphere app intermittently fails when using automation broker |
| 2021-06-02 | PSAAS-1646 | Mattermost app intermittently fails on action "upload file" when using automation broker |
| 2021-05-13 | PSAAS-1510 | Scrolling up and down the page messes with the height of the activity sidebar |
Versions 4.12.0 - 4.12.3
July 28, 2021 release 4.12.3
| Date resolved | Issue number | Description |
|---|---|---|
| 2021-07-23 | PSAAS-2691, PSAAS-2588 | The platform doesn't to properly terminate a python runner, causing playbooks to get stuck in running state if playbook terminated by a timeout. |
| 2021-06-28 | PSAAS-1758 | Playbook debug output doesn't print the playbook, repo, and user names on the first statement |
June 25, 2021 release 4.12.2
| Date resolved | Issue number | Description |
|---|---|---|
| 2021-06-23 | PSAAS-2028 | Investigation - Artifacts dropdown list not closed after selection |
| 2021-06-16 | PSAAS-1947 | Onboarding artifact with IP 60.163.90.8 leads to app error message |
| 2021-06-15 | PSAAS-1791 | Analyst queue page gets messy when an event name is too long and the new event above it doesn't show its correct name |
| 2021-06-15 | PSAAS-1792 | Investigation - the previous event is visible before the selected one is loaded |
| 2021-06-10 | PSAAS-1799 | Safari: cannot import event or playbook, tgz file not selectable |
| 2021-05-26 | PSAAS-1960 | Automation Broker: Cannot handle very large downloads or POSTs |
June 10, 2021 release 4.12.1
| Date resolved | Issue number | Description |
|---|---|---|
| 2021-06-08 | PSAAS-1798, PSAAS-2226, PSAAS-2081 | Playbook action fails with error message"Failed to send request to Automation Broker." |
| 2021-06-07 | PSAAS-1985 | Automation Broker does not support internal proxies. |
| 2021-06-07 | PSAAS-1895, PSAAS-1896 | Automation broker version not updated in UI after upgrading automation broker. |
Last modified on 10 December, 2024
| Known issues for | Compatibility with related Splunk products |
This documentation applies to the following versions of Splunk® SOAR (Cloud): current
Download manual
Feedback submitted, thanks!