What's new in Splunk SOAR Automation Broker

Splunk SOAR Automation Broker allows you to run playbooks, actions, or connect to applications or assets in your on-premises environment from your Splunk SOAR (Cloud) deployment.

You can use the Splunk SOAR Automation Broker to run playbooks, actions, or connect to applications or assets in segregated segments of your organization's network from your Splunk SOAR (On-premises) deployment.

September 2, 2026 Release 8.7.0

Automation Broker updates for Release 8.7

Important updates

Python 3.9: End of support

Starting with this release, the Splunk SOAR Automation Broker supports only Python 3.13.

Starting with this release, Splunk SOAR no longer supports Python 3.9. All SOAR automations, including playbooks, custom functions and apps, that are not compatible with 3.13 will no longer be executed.

For details on the self-service migration feature within the SOAR UI, automation scripts, and linting tools, see the list of references in How SOAR (Cloud) uses Python.

Documentation update

Known and fixed issues for Splunk SOAR Automation Broker are no longer listed separately in this manual. Find them in the Splunk SOAR (Cloud) Release Notes or Splunk SOAR (On-premises) Release Notes.

What's new in Splunk SOAR Automation Broker

This controlled availability release of Splunk SOAR Automation Broker includes the following enhancement:

In the Controlled Availability release stage, Splunk products may have limitations on customer access, features, maturity, and regional availability. For additional information on Controlled Availability please contact your Splunk representative.

Splunk Idea Feature Description

PPSID-I-439

PPSID-I-677

PPSID-I-992

PPSID-I-893

 Automation Broker High Availability (Controlled Availability) Create groups of Automation Brokers for high availability and scalability. Within each group, if one broker goes offline, traffic automatically switches to active brokers. Add brokers to a group to scale for higher loads and distribute work across them. For details, see About Splunk SOAR Automation Broker.

July 21, 2026 Release 8.6.0

Automation Broker updates for Release 8.6

Splunk SOAR currently supports the following:

  • Automation Broker with both Python 3.9 and Python 3.13 support

  • Automation Broker with only Python 3.13 support

Patch 8.6.0.536

This patch fixes the following issues:

  • PSAAS-34005: Automation Broker: Certificates require Authority Key Identifier in 8.6

  • PSAAS-34891: Automation Broker: NO_PROXY is not applied to websocket connections

April 8, 2026 Release 8.5.0

Release notes for Automation Broker, release 8.5.0

There are no new features in this Splunk SOAR Automation Broker release.

February 4, 2026 Release 8.4.0

Release notes for Automation Broker, release 8.4.0

There are no new features in this Splunk SOAR Automation Broker release.

November 6, 2025 Release 7.1.0

Release notes for Automation Broker, release 7.1.0

There are no new features in this Splunk SOAR Automation Broker release.

September 2, 2025 Release 7.0.0

Release notes for Automation Broker, 08/27/2025 release 7.0.0

Automation Broker update required

Action required: Automation Broker update required.

You must update your Automation Broker to release 7.0.0 or higher if all three of the following conditions exist in your organization:

  • Your organization uses a credentials manager, such as Hasicorp Vault, or Thycotic Secret Server and,

  • You have apps or assets that use an Automation Broker and,

  • The app or asset that uses an Automation Broker has been migrated to Python 3.13

Note: If you do not update the Automation Broker, app or asset actions will fail because they will not be able to authenticate using your organization's credentials manager.

To learn how to update your Splunk Automation Broker, see Upgrade or update Modern and Classic Splunk SOAR Automation Brokers in the Splunk SOAR Automation Broker documentation.

IPv6 supported

Splunk SOAR Automation Broker releases 7.0.0 and higher support IPv6.

When pairing your Automation Broker, you may specify an IPv6 address for Splunk SOAR (Cloud) or Splunk SOAR (On-premises) deployments running release 7.0.0 or higher. When specifying an IPv6 address, the address must be enclosed in square brackets.

Example:

CODE 
[2001:db8:3333:4444:5555:6666:7777:8888]

June 6, 2025, 6.4.1.361

The 6.4.1.361 of the Splunk SOAR Automation Broker container now includes the openssh-client library.

May 22, 2025, 6.4.1.355

The 6.4.1.353 release of the Splunk SOAR Automation Broker container shipped without an important library, libpq5. This library is important for connecting to PostgreSQL databases. Release 6.4.1.355 correctly includes the libpq5 library.

May 22, 2025, 6.4.1.353

Container internal operating system upgraded to Ubuntu 22.04 LTS.

April 10, 2025, 6.4.0.93

Container internal operating system upgraded to Ubuntu 22.04 LTS.

March 27, 2025

There are no new features in this release.

February 20, 2025

There are no new features in this release.

November 13, 2024

There are no new features in this release.

September 19, 2024

Feature Description
Automation broker supports just-in-time credential asset settings You can create assets that use "just in time" credentials with an Automation Broker. See Configure Just In Time Credentials for a Splunk SOAR (Cloud) asset in Add and configure apps and assets to provide actions in Splunk SOAR (Cloud).

May 29, 2024

Feature Description
Added environment variables to docker-compose.yaml Added two new environment variables:
  • PUID - This variable is the UI of the account that should run the Automation Broker. The default is 1000.
  • PGID - This variable is the GID of the account that should run the Automation Broker. The default is 1000.

March 28, 2024

This release of the Splunk SOAR Automation Broker updates the operating system inside the container to Ubuntu 20.04.

Feature Description
Replaced the operating system inside the container The operating system inside the Splunk SOAR Automation Broker's container has been replaced with Ubuntu 20.04.

November 30, 2023

This release of Splunk SOAR Automation Broker includes expanded support for privileged access managers such as CyberArk.

Feature Description
Improved support for CyberArk privileged access manager CyberArk integration with Splunk SOAR (Cloud) and Splunk SOAR (On-premises) was improved with their release 6.2.0. This Splunk SOAR Automation Broker supports those enhancements. For details, see Use CyberArk Vault Privileged Access Manager with Splunk SOAR (On-premises) in the Manage your organization's credentials with a password vault topic.