As of version 6.4.0, the visual editor for classic playbooks is no longer part of Splunk SOAR. Before upgrading, convert your classic playbooks to modern mode. Your classic playbooks will continue to run and you can view and edit them in the SOAR Python code editor.
For details, see:
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises).
For documentation on the most recent version, go to the latest release.
Known issues for
Release 6.3.0
Splunk SOAR version 6.3.0 includes the following known issues.
| Date filed | Issue number | Description |
|---|---|---|
| 2025-03-17 | PSAAS-22485 | Usernames containing commas (,) causing prompt block execution failures in playbooks |
| 2024-11-20 | PSAAS-20760 | Restarting phantom with telemetry off stops logs from being written to spawn.log |
| 2024-11-13 | PSAAS-20654 | Shutting down/restarting the system in a SOAR cluster without first shutting down SOAR caused ingestion intervals to be delayed Workaround: Clear stale Ingestion status records from the database by running the following sql: {noformat}UPDATE ingestion_status SET status='failed', task_state='finished' WHERE status='running' AND start_time < now() - Interval '24 hours';{noformat} The above will only mark records that are older than 24 hours as failed. Alternatively, disable polling on old assets and create new ones. |
| 2024-11-08 | PSAAS-20494, PSAAS-20496 | Multi-tenancy: Fail to run playbook configured with wildcard tenant (*) |
| 2024-11-06 | PSAAS-20435 | Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error |
| 2024-10-21 | PSAAS-20142 | VPE: Discarding changes doesn't reset the playbook editor for unconfigured action block |
| 2024-10-11 | PSAAS-20016 | SOAR Upgrade failure due to attempting to install SOAR when SOAR has already been installed |
| 2024-10-11 | PSAAS-20015 | 6.2.2 upgrade to 6.3.0 fails due to table "indicator_artifact_record_archive" already existing |
| 2024-10-04 | PSAAS-19942 | /opt/phantom/var/log/nginx/error.log is hard coded in config leads to error: No such file or directory |
| 2024-10-02 | PSAAS-19917, PSAAS-20071 | Reports page drop down results in 500 Server Error Workaround: You can work around this issue by changing your user settings for SOAR.
|
| 2024-09-25 | PSAAS-19798 | VPE: Action block not updating certain actions after unconfiguring Workaround: Add a new action block and reconfigure |
| 2024-09-24 | PSAAS-19708 | Playbooks might remain in pending status |
| 2024-09-12 | PSAAS-19457 | phantom.get_notes() fails with "failed to retrieve note Error: That page contains no results" when number of notes is multiple of page size |
| 2024-09-10 | PSAAS-19362 | Placeholder values for custom indexes in the Forwarder Settings modal don't match the actual default indexes |
| 2024-08-09 | PSAAS-18994 | Intermittent issues dragging new block connections |
| 2024-08-09 | PSAAS-18993 | VPE creates join function between blocks with no callbacks, resulting in functions being called twice |
| 2024-07-31 | PSAAS-18866, PSAAS-19037 | No redirection or toast if two tabs opened |
| 2024-06-24 | PSAAS-18174 | VPE: Error message "'NoneType' object has no attribute 'scm_id'" on first playbook save |
| 2024-04-17 | PSAAS-17305 | REST APIs with pagination give a 400 error |
| 2024-03-25 | PSAAS-16959 | Enabling the Secret Flag in Global Environment Variables Causes Automation Broker Test Connectivity/Poll Now to Fail Workaround: Remove the secret flag from all global environment variables for Test Connectivity to work with AB. |
| 2024-03-13 | PSAAS-16695 | VPE: Action block using Splunk app marked unconfigured when optional parameters not specified |
| 2024-03-06 | PSAAS-16642 | VPE: Deleting conditions from a filter block changes the conditions for downstream blocks instead of deleting them Workaround: If you have already deleted multiple conditions in the filter block configuration panel: If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.
|
| 2024-02-22 | PSAAS-16477 | Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>. |
| 2024-01-30 | PSAAS-16206 | Global Environment Variables are incorrectly applied by the Automation Broker when the variable is named as all lowercase letters Workaround: Use uppercase letters only. |
| 2023-08-25 | PSAAS-14609 | Automation Broker: Broker status should be updated if the broker directory is no longer present |
| 2022-02-03 | PSAAS-7499 | VPE: Playbook name field should be longer |
Last modified on 21 March, 2025
| Welcome to Splunk SOAR (On-premises) 6.3.0 | Fixed issues for |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.3.0
Download manual
Feedback submitted, thanks!