The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Known issues for
Release 6.3.1
Splunk SOAR version 6.3.1 includes the following known issues.
| Date filed | Issue number | Description |
|---|---|---|
| 2025-02-06 | PSAAS-21951 | "markdown supported" is appended to question for response type "1-100" and "Custom Range" |
| 2025-02-01 | PSAAS-21762 | Mobile: App cannot display any data (events, etc) from registered Soar instance |
| 2025-01-28 | PSAAS-21598 | SOAR local settings stored in the DB require a commit when in playbook view, but not when in listing page Workaround: Change settings on the playbook listing page instead of the Visual Playbook Editor view. |
| 2025-01-10 | PSAAS-21345 | Data preview is not refreshing the start block information when a new playbook is ran Workaround: Refresh the page after running a playbook to observe a change in the container. |
| 2025-01-02 | PSAAS-21211 | Playbook's loop exit condition uses stale container data when determining whether to exit |
| 2024-12-19 | PSAAS-21155 | VPE: Python editor and canvas are disabled when all python code is removed |
| 2024-12-03 | PSAAS-20901 | supervisord failing to start on warm standby instance |
| 2024-11-20 | PSAAS-20760 | Restarting phantom with telemetry off stops logs from being written to spawn.log |
| 2024-11-18 | PSAAS-20667 | Creating a new CEF field in datapath menu doesn't appear editable |
| 2024-11-13 | PSAAS-20654 | Shutting down/restarting the system in a SOAR cluster without first shutting down SOAR caused ingestion intervals to be delayed Workaround: Clear stale Ingestion status records from the database by running the following sql: {noformat}UPDATE ingestion_status SET status='failed', task_state='finished' WHERE status='running' AND start_time < now() - Interval '24 hours';{noformat} The above will only mark records that are older than 24 hours as failed. Alternatively, disable polling on old assets and create new ones. |
| 2024-11-06 | PSAAS-20437 | VPE: 'Key' field not editable Workaround: Copy the information you want to add and paste it into the key field. Right-click or control-click your mouse and select the Paste option from the context menu. Keyboard shortcuts do not work to paste information into this field. |
| 2024-10-28 | PSAAS-20299 | VPE: Slider bar in Debugger tab is too tiny to control |
| 2024-10-21 | PSAAS-20147 | VPE doesn't prevent user from spamming "Save and run" button, which can overload SOAR |
| 2024-10-18 | PSAAS-20124 | Currently selected block in VPE may not be highlighted correctly |
| 2024-10-15 | PSAAS-20040 | Order of blocks within Block results tab is incorrect Workaround: Customer can still accomplish flow |
| 2024-10-11 | PSAAS-20016 | SOAR Upgrade failure due to attempting to install SOAR when SOAR has already been installed |
| 2024-10-04 | PSAAS-19942 | /opt/phantom/var/log/nginx/error.log is hard coded in config leads to error: No such file or directory |
| 2024-09-27 | PSAAS-19843 | Playbook-type blocks: cannot filter on known data types, some input datapaths cannot be copied Workaround: Do not use the known data types filter. To copy a datapath, use the datapath picker in the configuration panel on the left of the screen. |
| 2024-09-12 | PSAAS-19457 | phantom.get_notes() fails with "failed to retrieve note Error: That page contains no results" when number of notes is multiple of page size |
| 2024-04-17 | PSAAS-17305 | REST APIs with pagination give a 400 error |
| 2024-03-25 | PSAAS-16959 | Enabling the Secret Flag in Global Environment Variables Causes AB Test Connectivity/Poll Now to Fail Workaround: Remove the secret flag from all global environment variables for Test Connectivity to work with AB. |
| 2024-03-13 | PSAAS-16695 | VPE: Action block using Splunk app marked unconfigured when optional parameters not specified |
| 2024-03-06 | PSAAS-16642 | VPE: Deleting conditions from a filter block changes the conditions for downstream blocks instead of deleting them Workaround: If you have already deleted multiple conditions in the filter block configuration panel: If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.
|
| 2024-02-22 | PSAAS-16477 | Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>. |
| 2024-01-30 | PSAAS-16206 | Global Environment Variables are incorrectly applied by the Automation Broker when the variable is named as all lowercase letters Workaround: Use uppercase letters only. |
| 2023-08-25 | PSAAS-14609 | Automation Broker: Broker status should be updated if the broker directory is no longer present |
Last modified on 13 February, 2025
| Welcome to Splunk SOAR (On-premises) 6.3.1 | Fixed issues for |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.3.1
Download manual
Feedback submitted, thanks!