The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises).
For documentation on the most recent version, go to the latest release.
Known issues for
Release 6.3.0
Splunk SOAR version 6.3.0 includes the following known issues.
| Date filed | Issue number | Description |
|---|---|---|
| 2024-11-13 | PSAAS-20654 | Shutting down/restarting the system in a SOAR cluster without first shutting down SOAR can cause ingestion intervals to be delayed Workaround: Clear stale Ingestion status records from the database by running the following sql: {noformat}UPDATE ingestion_status SET status='failed', task_state='finished' WHERE status='running' AND start_time < now() - Interval '24 hours';{noformat} The above will only mark records that are older than 24 hours as failed. Alternatively, disable polling on old assets and create new ones. |
| 2024-11-08 | PSAAS-20494, PSAAS-20496 | Multi-tenancy: Fail to run playbook configured with wildcard tenant (*) |
| 2024-11-06 | PSAAS-20435 | Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error |
| 2024-10-21 | PSAAS-20142 | VPE Discard changes doesn't reset the playbook editor for unconfigured action block |
| 2024-10-11 | PSAAS-20015 | 6.2.2 upgrade to 6.3.0 fails due to table "indicator_artifact_record_archive" already existing |
| 2024-10-02 | PSAAS-19917, PSAAS-20071 | Reports page drop down results in 500 Server Error Workaround: You can work around this issue by changing your user settings for SOAR.
|
| 2024-09-25 | PSAAS-19798 | VPE: Action block not updating certain actions after unconfiguring Workaround: Add a new action block and reconfigure |
| 2024-09-24 | PSAAS-19708 | Playbooks might remain in pending status |
| 2024-09-10 | PSAAS-19362 | Placeholder values for custom indexes in the Forwarder Settings modal don't match the actual default indexes |
| 2024-08-21 | PSAAS-19137 | No playbook run created when playbook label differs from container label instead of failing playbook run |
| 2024-08-09 | PSAAS-18993 | VPE creates join function between blocks with no callbacks, resulting in functions being called twice |
| 2024-08-09 | PSAAS-18994 | Intermittent issues dragging new block connections |
| 2024-07-31 | PSAAS-18866, PSAAS-19037 | No redirection or toast if two tabs opened |
| 2024-06-24 | PSAAS-18174 | VPE message "'NoneType' object has no attribute 'scm_id'" on first save |
| 2024-03-25 | PSAAS-16959 | Enabling the Secret Flag in Global Environment Variables Causes AB Test Connectivity/Poll Now to Fail Workaround: Remove the secret flag from all global environment variables for Test Connectivity to work with AB. |
| 2024-02-22 | PSAAS-16477 | Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>. |
| 2022-02-03 | PSAAS-7499 | VPE: Playbook name field should be longer |
Last modified on 16 December, 2024
| Welcome to Splunk SOAR (On-premises) 6.3.0 | Fixed issues for |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.3.0
Download manual
Feedback submitted, thanks!