Splunk® SOAR (On-premises)

Release Notes

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Known issues for

Release 6.3.0

Splunk SOAR version 6.3.0 includes the following known issues.

Date filed Issue number Description
2024-11-13 PSAAS-20654 Shutting down/restarting the system in a SOAR cluster without first shutting down SOAR can cause ingestion intervals to be delayed

Workaround:
Clear stale Ingestion status records from the database by running the following sql:

{noformat}UPDATE ingestion_status SET status='failed', task_state='finished' WHERE status='running' AND start_time < now() - Interval '24 hours';{noformat}

The above will only mark records that are older than 24 hours as failed.

Alternatively, disable polling on old assets and create new ones.

2024-11-08 PSAAS-20494, PSAAS-20496 Multi-tenancy: Fail to run playbook configured with wildcard tenant (*)
2024-11-06 PSAAS-20435 Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error
2024-10-21 PSAAS-20142 VPE Discard changes doesn't reset the playbook editor for unconfigured action block
2024-10-11 PSAAS-20015 6.2.2 upgrade to 6.3.0 fails due to table "indicator_artifact_record_archive" already existing
2024-10-02 PSAAS-19917, PSAAS-20071 Reports page drop down results in 500 Server Error

Workaround:
You can work around this issue by changing your user settings for SOAR.
  1. From the User Account Menu, select Account Settings.
  2. Uncheck the box marked Display Relative Time.
  3. Click Save Changes.

2024-09-25 PSAAS-19798 VPE: Action block not updating certain actions after unconfiguring

Workaround:
Add a new action block and reconfigure
2024-09-10 PSAAS-19362 Placeholder values for custom indexes in the Forwarder Settings modal don't match the actual default indexes
2024-08-21 PSAAS-19137 No playbook run created when playbook label differs from container label instead of failing playbook run
2024-08-09 PSAAS-18993 VPE creates join function between blocks with no callbacks, resulting in functions being called twice
2024-08-09 PSAAS-18994 Intermittent issues dragging new block connections
2024-07-31 PSAAS-18866, PSAAS-19037 No redirection or toast if two tabs opened
2024-06-24 PSAAS-18174 VPE message "'NoneType' object has no attribute 'scm_id'" on first save
2022-02-03 PSAAS-7499 VPE: Playbook name field should be longer
Last modified on 02 December, 2024
Welcome to Splunk SOAR (On-premises) 6.3.0   Fixed issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters