Splunk® SOAR (On-premises)

Release Notes

The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Fixed issues for

Release 6.0.2 includes the following fixed issues, in addition to issues fixed in Release 6.0.1 and Release 6.0.0, described below.

Release 6.0.2

Date resolved Issue number Description
2023-06-14 PSAAS-13519, PSAAS-13538 Auth tokens expire after 30 days; tokens should not expire

The ph-auth-token for any automation user account will expire 30 days after it is generated. In releases prior to 6.0.0, these tokens did not expire. You might see a 401 Invalid Token error when using these tokens to call the Splunk SOAR API or running actions using an app with an asset configurations that uses these tokens.
2023-06-8 PSAAS-13503 When a user without system_settings view permission switches tabs from the SOAR homepage, the SOAR UI and apps become unresponsive.

Release 6.0.1

Date resolved Issue number Description
2023-05-18 PSAAS-10127 Playbooks using Threat Grid or urlscan.io app hang on the detonation action
2023-05-10 PSAAS-13273 Daemon DecideD frequently crashed and restarted
2023-04-18 PSAAS-13091 SOAR upgrade from 5.2.1 to 5.3.x will fail if a python3 app has been uninstalled
2023-04-13 PSAAS-13062 Reverts PSAAS-11066 in 6.0.0 - User with the "view" permission in one tenant is able to edit assets in other tenants
2023-04-10 PSAAS-12370 VPE: Downstream datapath variable values are replaced with variable name in various block types after upgrade
2023-04-07 PSAAS-11587 A successful completion of called playbook in Synchronous mode, over-writes failure result in calling playbook
2023-04-07 PSAAS-12333 Playbooks that open with smart block context warnings will disable the debugger and display 'Discard Changes' button
2023-04-05 PSAAS-11960 VPE: "Refresh Event Data" in Utility block removes some of the original container information
2023-04-05 PSAAS-12592 VPE: Screen goes blank when loading playbook in v6.0 worked in v5.5
2023-04-04 PSAAS-12839 GitRepos Installer step can fail on upgrades if the community repo has been disabled and duplicate playbooks exist in the db.
2023-04-03 PSAAS-12766 Cannot Subscribe to more than one scheduled report in UI
2023-04-03 PSAAS-12427, PSAAS-12635 Python2 deprecation notice task in the installer fails if there are pipe characters in the repo/playbook/cf names.
2023-03-30 PSAAS-11509 Third-party license information is included in documentation, but not in the product UI
2023-03-30 PSAAS-12147 System health charts truncate values
2023-03-29 PSAAS-12842 When using an internal IdP for SAML2 auth, an error from incorrectly parsed XML prevents users from logging in
2023-03-28 PSAAS-12767 App install with Chrome browser: Browser crashes when installing a TAR or TGZ file
2023-03-28 PSAAS-12369 Logrotate fails because of syntax error in the config file
2023-03-28 PSAAS-12851, PSAAS-12434 Port forward created by Priv to unpriv migration does not work on the loopback interface
2023-03-27 PSAAS-12311, PSAAS-12328 Prompt block icon disappear after creating more than one empty questions
2023-03-27 PSAAS-12307 VPE: Playbook Block: After multi-selecting inputs, deleting all selections and adding new selection has a comma prepended to datapath
2023-03-27 PSAAS-12319 update_certificates status command should not fail on clusters that are not using glusterfs for shared filesystem
2023-03-27 PSAAS-12328, PSAAS-12311 VPE: End block icon disappear after creating more than one empty questions
2023-03-22 PSAAS-11797 App actions fail due to unescaped null characters (PSAAS-10127)
2023-03-21 PSAAS-12284 Playbook input variables are marked as invalid within an input playbook
2023-03-21 PSAAS-12637 Documentation: Cannot render specific div's from README.md properly on documentation page
2023-03-21 PSAAS-12470 custom app install fails with "Multiple app directories detected." after upgrading from 5.5.0 to 6.0.0
2023-03-20 PSAAS-11581 PlaybookRunEx::UpdateStatus fails to update when playbook run is very old.
2023-03-16 PSAAS-12174 recreate_local_db.pyc fails with "FileNotFoundError: No such file or directory: '/opt/phantom/dependencies/systemconfigs/opt/phantom/data/db/pg_hba.conf'"
2023-03-07 PSAAS-11908, PSAAS-11910 Script "port_forward configure" flag "--no-prompt" doesn't work
2023-03-06 PSAAS-12378 6.0.0. upgrade script bypasses creating soar_local_admin step even if existing soar_local_admin users have bee deleted
2023-02-27 PSAAS-11472 test_connectivity action fails with an asset using hashicorp vault credential manager on app editor
2023-02-27 PSAAS-12266 Apps: Non compliant FIPS staged app fails to install
2023-02-21 PSAAS-11001 Wrong results in PB: "NOT IN" clause wrongly returns FALSE in SOAR when there is a null value in its condition
2023-02-06 PSAAS-12004 Playbook processing stops when Python runners time out and not get restarted
2023-01-30 PSAAS-11995 phenv command does not produce expected results when telemetry is turned off
2023-01-30 PSAAS-11802 Artifact save invokes indicator extraction when indicator feature is disabled.
2023-01-25 PSAAS-10582 UI crash: opening container with a HUD CARD using a Custom Field and a list value leads to a blank page.
2022-12-21 PSAAS-11389 Git app: Action git commit fails
2022-11-29 PSAAS-10817 Bulk edit of Python 2 playbook properties is not blocked

Release 6.0.0

Date resolved Issue number Description
2023-03-27 PSAAS-12057 Automation Broker (AB) configuration is ignored in the app editor
2023-02-21 PSAAS-11648 Analyst Queue: When applying filters for owner for cases and events, the metrics at the top of the case screen do not change (containers are filtered)
2023-02-15 PSAAS-12280 VPE: Playbook block inputs: text is deleted/added while user types
2023-02-09 PSAAS-11841 Upgrading a SOAR instance to 5.5 does not change the community repo branch to 5.5
2023-02-08 PSAAS-11979 VPE: clicking on a block does not bring up the sidebar for editing conditions
2023-02-03 PSAAS-11650, PSAAS-12122 VPE : Existing input playbook blocks are not configurable to change the input source
2023-02-01 PSAAS-11514 VPE smart block context not taking into account custom datapaths
2023-01-31 PSAAS-11458 Cleaning up containers via Data Retention causing excessive disk space usage
2023-01-31 PSAAS-11997 Questions regarding python pandas/tabulate library in SOAR 5.5 - Pandas requires version '0.8.3' or newer of 'tabulate' (version '0.8.1' currently installed)
2023-01-30 PSAAS-9891 Indicators are visible with labels that roles do not allow
2023-01-30 PSAAS-11874 Reindexing 'asset' index does not work on Elastic Search
2023-01-27 PSAAS-5408 /rest/widget_data/top_playbooks_actions endpoint returns invalid playbook_name field with tags
2023-01-27 PSAAS-11242 VPE: After correct reconfiguration, "invalid resource" warning persists within subplaybook block
2023-01-20 PSAAS-11004, PSAAS-11658 VPE: Values entered into custom function/Utility input arguments are deleted or modified
2023-01-17 PSAAS-11068 Port forward from NRI port to 443 doesn't work on local machine.
2023-01-13 PSAAS-11799 Forwarding data to Elastic Search does not work
2023-01-13 PSAAS-9054 VPE : Playbooks fail to save: No name 'rules' in module 'phantom'
2023-01-10 PSAAS-11328 VPE Empty Variables with inconsistent use of quotes
2023-01-10 PSAAS-11423 Custom Function Editor: Not saving data type change
2023-01-10 PSAAS-11694 VPE/prompt: "Could not find 'undefined' in users or roles" during playbook runs after upgrading from 5.4.0 and editing/saving the playbook
2023-01-09 PSAAS-11057 Ingestd Daemon can hang during poll now in rare scenarios.
2023-01-04 PSAAS-11401 Automation Broker generates a high volume of extraneous audit log records.
2022-12-13 PSAAS-10503 Decided cancels running playbooks on ALL nodes after restarting
2022-12-09 PSAAS-10997 Playbook decision block convert boolean strings to boolean values
2022-12-06 PSAAS-10703 Default workbook is reset on upgrade if the original default has been removed
2022-11-29 PSAAS-11181 Fix page crash on load for blocks using external resources
Last modified on 05 March, 2024
Known issues for   Compatibility with related Splunk products

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.0.2








You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters