About Splunk SOAR Automation Broker

You can run actions in playbooks or on an ad hoc basis while investigating a notable in Splunk SOAR. If those actions involve on-premises applications or assets, you must set up and install the Splunk SOAR Automation Broker in order to run those actions. You can use the Splunk SOAR Automation Broker to run actions from Splunk SOAR in your on-premises environment.

Splunk SOAR Automation Broker can be used with either Splunk SOAR (Cloud) or Splunk SOAR (On-premises).

Note: The Splunk SOAR Automation Broker is not supported in a Splunk SOAR (On-premises) cluster.

Splunk SOAR uses an on-premises application, the Splunk SOAR Automation Broker, to securely run actions through connections to your on-premises tools and applications. Splunk SOAR sends an action request for a specific connector configuration to the Splunk SOAR Automation Broker. In combination with the connector, the Splunk SOAR Automation Broker dispatches the action to the relevant on-premises application.

After the action run completes, the action results are securely communicated to Splunk SOAR using REST and HTTPS.

Note: You don't need the Splunk SOAR Automation Broker to run actions and see the results of those action runs with connectors on your Splunk SOAR (Cloud) instance.

Modern and Classic Automation Brokers

distinguishes between the two types of Automation Brokers

Starting in Splunk SOAR version 8.7.0, there are two types of Splunk SOAR Automation Brokers: Modern and Classic (Legacy). Follow the documentation that corresponds to the appropriate broker type.

Modern Automation Brokers

Modern Automation Brokers can be used in groups for high availability, including load balancing and failover. Modern brokers are built on AMQP messaging, an open-source protocol.

High availability has the following benefits:

  • Assets can target a group of brokers. Work is placed in a shared queue and the first available broker in the group picks up the work.

  • If a broker is busy, upgrading, or not functioning, another broker in the group automatically picks up the work.

  • If you need to replace or restart a broker, new work continues to flow to the remaining brokers, uninterrupted.

  • Modern brokers that are not a part of a group are called standalone or single Automation Brokers.

The following diagrams show Modern Automation Brokers in cloud and on-premises deployments.

Diagram showing Modern Splunk SOAR Automation Brokers used with Splunk SOAR (Cloud): This screen image shows a flowchart of how the Modern Splunk Automation Broker works with Splunk SOAR (Cloud). On the left is a cloud icon surrounding an icon for a web-based user interface. From the top of this icon, several lines capped with boxes represent connectors to cloud services. A double-headed arrow points to and from an Automation Broker Group, located within a box indicating your network. The arrow represents two-way traffic flow on AMQPS on port 5671. This traffic is load-balanced among brokers in the Automation Broker group. The Automation Broker group can contain one or more individual Brokers. To the side of the Broker Group, also within your network, is a container indicating your on-premises assets, like firewalls, EDR ticketing, IdP, and more. From that container, several lines capped with boxes represent connectors to on-premises services. A unidirectional arrow points from the Automation Broker group to your on-premises assets, noting that any active broker can run an action on these assets. The second arrow points from your on-premises services, transporting action run results and logs back to the Automation Broker group.

Diagram showing Modern Splunk SOAR Automation Brokers used with Splunk SOAR (On-premises): This screen image shows a flowchart of how the Modern Splunk Automation Broker works with Splunk SOAR (On-premises). On the left is a cloud icon surrounding an icon for a remote area of your network. From the top of this icon, several lines capped with boxes represent connectors to services. A double-headed arrow points to and from an Automation Broker Group, which can contain one or more individual Brokers. The arrow represents two-way traffic flow via service-specific ports and protocols. All broker group members are active consumers of these messages. To the side of the Broker Group, also within your network, is a container indicating Splunk SOAR (On-premises). From that container, several lines capped with boxes represent connectors to on-premises services. A unidirectional arrow points from the Automation Broker group to SOAR (On-premises), noting that any active broker can run an action on these assets. The second arrow points from Splunk SOAR (On-premises), transporting action run results and logs back to the Automation Broker group.

Broker Manager

Modern Automation Brokers use the Broker Manager.

The Splunk SOAR Broker Manager starts, restarts, upgrades, and checks the health of the Automation Broker container that connects your local network or private environment to Splunk SOAR. It runs as a container on the same host as Splunk Automation Broker.

Use the Broker Manager when the Automation Broker needs to run outside of the Splunk SOAR instance, such as in an on-premises network, private cloud, or another network segment where actions must reach local systems.

Classic (Legacy) Automation Brokers

Note: Classic Automation Brokers will be deprecated soon. Create Modern Automation Brokers.

Classic (Legacy) Automation Brokers are based on websockets and have been available for years. You can continue to use them until they are eventually deprecated and removed. You cannot use Classic Automation Brokers in groups.

The following diagrams show Classic Automation Brokers in cloud and on-premises deployments.

Diagram showing Splunk SOAR Automation Broker used with Splunk SOAR (Cloud): This screen image shows a flowchart of how the Splunk Automation Broker works with Splunk SOAR (Cloud). On the left is a cloud icon surrounding an icon for a web-based user interface. From the top of this icon, several lines capped with boxes represent connectors to cloud services. A double-headed arrow points to and from a cloud icon representing the Cloud Gateway Service in the center of the image. An icon representing the Splunk Automation Broker is on the other side of the Cloud Gateway Service. From the top of that icon, on the right, several lines capped with boxes represent connectors to on-premises services. Two unidirectional arrows point from the Splunk Automation Broker. The first arrow points directly to Splunk SOAR (Cloud), transporting action results and logs. The second arrow points to the Cloud Gateway Service, transporting action requests.

Diagram showing Splunk SOAR Automation Broker used with Splunk SOAR (On-premises): This screen image shows a flowchart of how the Splunk Automation Broker works with Splunk SOAR (On-premises). On the left is a cloud icon surrounding an icon for a web-based user interface. From the top of this icon, several lines capped with boxes represent connectors to remote network segment's services. An icon representing the Splunk Automation Broker appears in the center of the image. An icon representing the on-premises system is on the other side of the Splunk Automation Broker. From the top of that icon, on the right, several lines capped with boxes represent connectors to on-premises services. Two bidirectional arrows point from the Splunk Automation Broker to both the web-based, remote network segment on the left and the rest of the network on the right. The first arrow points directly to Splunk SOAR (Cloud), transporting action results and logs. The second arrow points to the Cloud Gateway Service, transporting action requests.

About the Splunk SOAR Automation Broker container

The Splunk SOAR Automation Broker is delivered as a Docker container.

  • Modern Automation Brokers: In release 8.7.0 and higher, the Automation Broker uses Ubuntu 22.04. The Splunk SOAR Broker Manager uses Debian 13 (Trixie) container.
  • Classic Automation Brokers: In release 6.4.0.93 and higher, the base operating system inside the container is fully updated Ubuntu 22.04.

Each Splunk SOAR Automation Broker release has all operating system patches applied when it is built.

Matching the Splunk SOAR Automation Broker with Splunk SOAR releases

Splunk SOAR (Cloud) and Splunk SOAR (On-premises) releases 6.4.1 and higher enforce versioning for the Splunk SOAR Automation Broker. You must use a release of the Splunk SOAR Automation Broker that is supported for use with your release of Splunk SOAR (Cloud) or Splunk SOAR (On-premises). Splunk SOAR versions may disconnect from Splunk SOAR Automation Brokers which are outside of the supported versions.

Supported releases for the Splunk SOAR Automation Broker are calculated as "N-1" where "N" is the current release of Splunk SOAR.

  • N: The Splunk SOAR Automation Broker release version matching the release version of Splunk SOAR.
  • N-1: The previous release version of Splunk SOAR Automation Broker.

Example: If you are using Splunk SOAR (Cloud) release 6.4.1, then you must use either the matching 6.4.1 or the 6.4.0 tagged release of the Splunk SOAR Automation Broker.

See these topics for more information on installing, upgrading, or interacting with the Automation Broker.

Communications limits

The Splunk SOAR Automation Broker supports transferring action requests or action results and logs up to 100MB in size.