Known issues for

Release 6.4.0

Splunk SOAR version 6.4.0 includes the following known issues.

Date filed	Issue number	Description
2025-03-31	PSAAS-22699	action_result.summary.responder_email datapath is not populated
2025-03-19	PSAAS-22558	Setting SAML2 metadata URL to https://<stack>/saml2/metadata locks up UWSGI Workaround: Disable the customer's broken SAML2 config
2025-03-18	PSAAS-22553	VPE: Could not run classic VPE playbook after it's opened; Need to save first Workaround: Click "Discard Changes" button.
2025-03-03	PSAAS-22258	Report pdf fails to download Workaround: Take a snap of your environment before you follow these steps. Verify which wkhtmltopdf package to download. https://github.com/wkhtmltopdf/packaging/releases/0.12.6-1 From the SOAR CLI download wkhtmltopdf: (example shown is for Centos/RHEL 8) wget https://github.com/wkhtmltopdf/packaging/releases/0.12.6-1/wkhtmltox-0.12.6-1.centos8.x86_64.rpm Yum install any required dependancies. (example shown is for a default install of Centos 8) yum install -y libX11 libXext libXrender libjpeg xorg-x11-fonts-75dpi xorg-x11-fonts-Type1 Install wkhtmltopdf: rpm -Uvh wkhtmltox-0.12.6-1.centos8.x86_64.rpm Symlink wkhtmltopdf to /usr/bin: ln -s /usr/local/bin/wkhtmlto* /usr/bin/ Restart SOAR. (example shown uses the default SOAR install path) /opt/phantom/bin/stop_phantom.sh && /opt/phantom/bin/start_phantom.sh
2025-02-24	PSAAS-22171	App packaged on MacOS: App's TGZ file might contain MacOS metadata, so SOAR cannot load the app's JSON Workaround: The problem stems from MacOS creating hidden files with binary data and ".json" extensions, with names that start with "._". Workarounds include: When creating a custom app package on MacOS, add a command line flag "--no-mac-metadata" to the tar command used to package the app. This will exclude the offending files from the package and allow it to function properly when uploaded to Splunk SOAR. When an app containing these metadata files is packaged for export by the Splunk SOAR app editor, hidden files are ignored. So you can exclude the extraneous metadata files by exporting an existing app package from Splunk SOAR and reinstalling it via the package upload UI. Note: If the affected app is configured to run on an Automation Broker, you might need to force the Automation Broker to redownload the app from SOAR by either incrementing the app's version number or by deleting the app's directory in your broker's "splunk_data" volume.
2025-01-29	PSAAS-21645	VPE Data Preview: Quick action menu does not produce usable data paths in real view Workaround: Use the copy button instead of the quick action menu.
2025-01-23	PSAAS-21528	Saving classic playbook shows Playbook Run Statistics modal but doesn't update code once accepted
2025-01-23	PSAAS-21530	VPE decision block shows invalid warning "Missing comparison value" when there is an "else" condition
2024-11-20	PSAAS-20760	Restarting phantom with telemetry off stops logs from being written to spawn.log
2024-02-22	PSAAS-16477	Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-12-11	PSAAS-15750	VPE: Downstream block invoked twice from join between two upstream code blocks Workaround: Detach one of the upstream blocks and run the blocks in sequence to avoid a join.
2023-06-12	PSAAS-13720	VPE: Playbooks become unresponsive when using an input playbook with "" in the name Workaround: Give the Playbook Action Block in the Automation Playbook a Custom Name that does not contain "[]" chars before having a filter reference the output of the Playbook Action Block.