Known issues for

Release 6.4.1

Splunk SOAR version 6.4.1 includes the following known issues.

Date filed	Issue number	Description
2025-06-11	PSAAS-24101	REGRESSION: VPE is not showing templates when configuring "promote to case" in Utility block Workaround: After adding the promote to case utility block, edit the block's Python code. Update phantom.promote() to be: phantom.promote(container=container, template=<workbook name>) where workbook name is one of the workbooks listed in /admin/workbooks. Be sure to copy the name exactly. An example would look like this: phantom.promote(container=container, template="Account Compromise") Note that after making this change, the VPE will consider this to be custom code.
2025-05-28	PSAAS-23958	Webhooks querystring parameters are parsed incorrectly
2025-05-19	PSAAS-23626	Playbook prompt blocks: Response is required, regardless of "Required" field setting
2025-04-16	PSAAS-23000, PSAAS-22994	Join Settings are not copied in copy paste
2025-04-01	PSAAS-22727	action_result.summary.responder_email datapath is not populated
2025-03-17	PSAAS-22485	Usernames containing commas (,) cause prompt block execution failures in playbooks
2025-01-16	PSAAS-21440	VPE: Blocks in top right area of the canvas cannot be selected when there is an error message Workaround: Move the canvas to a location on your screen where blocks are not obscured by error messages. To move the canvas, select a blank area of the canvas and drag it to another location on your screen.
2025-01-09	PSAAS-21330	VPE: Renaming a joined block causes the join settings to be invalid. Workaround: To update playbooks where you have renamed a block or updated join settings follow these steps. Open the affected playbook. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings, or have renamed a block. Ensure that the join settings are configured appropriately. Save the playbook.
2024-02-22	PSAAS-16477	Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.