Platform installation for Python 3

The Splunk SOAR installation includes a Python 3 runtime environment.

If you are developing an app, Splunk SOAR (Cloud) supports apps written in Python 3.13 and 3.9. Python 3.9 support will end soon. Python 2 is not supported.

Note: Beginning with Splunk SOAR version 7.0.0, Splunk supports custom Python packages starting with Python 3.13.

Python installation path

Only Python 3 is included in the platform installation.

Use the following Python paths, where, in Splunk SOAR (Cloud) installations, <SOAR_HOME> is /opt/phantom.:

  • Python 3.13: <SOAR_HOME>/usr/python313/bin/python3.13

  • Python 3.9: <SOAR_HOME>/usr/python39/bin/python3.9

The <SOAR_HOME>/usr/bin/python3 symlink is included for convenience in accessing the Python 3.13 install, located at /opt/phantom/usr/python313/bin/python3.13

Custom Python packages

Link to information on using custom Python packages in SOAR

Beginning with Splunk SOAR version 7.0.0, Splunk supports custom Python packages starting with Python 3.13.

For details on installing and working with custom Python Packages, refer to Manage automation dependencies in the Administer Splunk SOAR documentation.

App development script installation path

Note: This entire section refers to scripts and CLI/SSH items which are not available in Splunk SOAR (Cloud). If you want to use a playbook action that requires packages that weren't installed in Splunk SOAR (Cloud), create a custom app to import the package and then build the app that contains the actions needed. See Create an app with the App Wizard.

The following scripts and commands are included in the platform for developing Python 3 apps:

  • create_tj.pyc
  • create_output.pyc
  • phenv compile_app command

Compatible Python 3 scripts

Scripts that are compatible with Python 3 are included in the following location:

  • For Splunk SOAR (Cloud) deployments, <SOAR_HOME> is /opt/phantom.
  • For Splunk SOAR ((On-premises) privileged deployments prior to release 5.4.0, <SOAR_HOME> is /opt/phantom.
  • For Splunk SOAR (On-premises) unprivileged deployments, <SOAR_HOME> is configured by your Splunk SOAR Administrator.
  • The path to scripts is <SOAR_HOME>/bin/<script>.

Run the scripts using phenv python3 as follows: 

[phantom@phantom phipinfoio]$ phenv python <SOAR_HOME>/bin/<script>.pyc