Splunk® SOAR (On-premises)

Release Notes

Acrobat logo Download manual as PDF


The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Welcome to 5.4.0

If you are new to , read About in the Use manual to learn how you can use for security automation.

Support for privileged installations has been removed

The 5.4.0 release of Splunk SOAR (On-premises) removes support for privileged installations, for both new deployments or upgrades of existing deployments.

Upgrading a deployment to release 5.4.0 will convert a privileged deployment to an unprivileged one.

What's new in 5.4.0

This release of includes the following enhancements.

Feature Description
Support for privileged deployments removed You cannot create new privileged deployments. Existing privileged deployments will be converted to unprivileged deployments during upgrade. See Convert a privileged deployment to an unprivileged deployment in Install and Upgrade Splunk SOAR (On-premises).
  • files, directories, and processes belong to the user phantom.
  • Unprivileged instances of bind to a different HTTPS port.
  • In clusters, each privileged node will be converted to unprivileged one as you upgrade them.
  • For deployments using warm standby, the primary and the standby will individually convert when you upgrade them.

For a more detailed explanation of the changes when a is converted to unprivileged, see Convert a privileged deployment to an unprivileged deployment in Install and Upgrade Splunk SOAR (On-premises).

If your Splunk SOAR (On-premises) release 5.3.5 deployment cannot or does not use firewalld, see Convert a privileged deployment to an unprivileged deployment for additional steps to do before upgrading to release 5.4.0.

Splunk SOAR Automation Broker available You can now use the Splunk SOAR Automation Broker in deployments. The Splunk SOAR Automation Broker acts to connect assets in complex network configurations to your instance. See Set Up and Manage the Splunk SOAR Automation Broker.

See also

  • For known issues in this release, see Known issues for .
  • For fixed issues in this release, see Fixed issues for .
  • For release notes for the Splunk SOAR Automation Broker, see Release Notes in the Set up and manage Splunk Automation Broker documentation.
Last modified on 22 February, 2024
  NEXT
Known issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.4.0

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters