To move the canvas, select a blank area of the canvas and drag it to another location on your screen.

docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.

To fix this issue, perform either of these actions:

• In the asset settings, select Verify server certificate.
• Pair the Automation Broker without TLS certificate check by using the -e PHANTOM_HTTPS_STRICT_TLS_AUTODETECT=0 -e PHANTOM_HTTPS_STRICT_TLS=0  option.

Workarounds include:

• When creating a custom app package on MacOS, add a command line flag "--no-mac-metadata" to the tar command used to package the app. This will exclude the offending files from the package and allow it to function properly when uploaded to Splunk SOAR.
• When an app containing these metadata files is packaged for export by the Splunk SOAR app editor, hidden files are ignored. So you can exclude the extraneous metadata files by exporting an existing app package from Splunk SOAR and reinstalling it via the package upload UI.

Note: If the affected app is configured to run on an Automation Broker, you might need to force the Automation Broker to redownload the app from SOAR by either incrementing the app's version number or by deleting the app's directory in your broker's "splunk_data" volume.

To move the canvas, select a blank area of the canvas and drag it to another location on your screen.

docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.

To fix this issue, perform either of these actions:

• In the asset settings, select Verify server certificate.
• Pair the Automation Broker without TLS certificate check by using the -e PHANTOM_HTTPS_STRICT_TLS_AUTODETECT=0 -e PHANTOM_HTTPS_STRICT_TLS=0  option.

To move the canvas, select a blank area of the canvas and drag it to another location on your screen.

If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.

• If the conditions match: No further action is required.
• If the conditions do not match: For all downstream connections, re-select the condition labels to match the conditions in the filter block configuration panel.

docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.

1. From the User Account Menu, select Account Settings.
2. Uncheck the box marked Display Relative Time.
3. Click Save Changes.

If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.

• If the conditions match: No further action is required.
• If the conditions do not match: For all downstream connections, re-select the condition labels to match the conditions in the filter block configuration panel.

docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.

• Playbook Runs [/topic/topic/body/section/table/tgroup/tbody/row/entry/ul/li/codeph/codeblock {""}) phenv phantom_shell >>> ids = [<list>, <of>, <playbook_run>, <ids>] >>> Container.objects.filter(closing_rule_run_id__in=ids).update(closing_rule_run=None) (codeblock]
[/topic/topic/body/section/table/tgroup/tbody/row/entry/ul/li {""}) Apps [/topic/topic/body/section/table/tgroup/tbody/row/entry/ul/li/p {""}) Normally, apps are soft deleted. However, there is an edge case to be aware of: installing a previously deleted app for which all assets have been deleted or orphaned may delete containers and associated data originally created by the app, if and only if the app reinstallation process fails. This can be prevented by incrementing an app package's version in order to upgrade, instead of performing a delete and reinstall of the same app version. (p] (li]

1. Make a POST call to [https:brsoar-ro.soar.splunkcloud.com/rest/system_settings/events brsoar-ro.soar.splunkcloud.com/rest/system_settings/events] with the payload

   
   
   {"add_label":true,"label_name":"test"}
   
   

2. Observe on the administration page, the label test should display when you navigate to Administration, then select Label settings.

To stop the error from printing entirely, copy the following code and replace line 13 of the existing start_phantom.sh code.

if remote_db_in_install_conf && ! dev_in_install_conf && [ ${PHANTOM_IS_CLOUD} != 1 ]; then
must_have_minimum_postgresql_version
fi

If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.

• If the conditions match: No further action is required.
• If the conditions do not match: For all downstream connections, re-select the condition labels to match the conditions in the filter block configuration panel.

docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.

This helps us avoid OOMing in Django while preserving audit capability when performing a deletion thanks to a new pg trigger that was added.

In SOAR versions pre 6.3.0, customers running into an OOM when deleting a container with 1000+ artifacts should delete the container via a raw delete using the delete_db_containers management command. If this is a cloud customer, then SOAR on-call will need to delete the container for them with their permission.

If you need to update the playbook, take the following action: After you migrate the playbook, delete the affected utility block, then re-add the block and make any updates.

• If you have a parent and child playbook that each update fields in the container, call those child playbooks synchronously, so they are not able to perform updates at the same time.
• Bundle your container updates into a single playbook.

this can should be resolved by clicking auto-arrange

1. Check if the action completed successfully.
2. Cancel the hanging action.
3. If the action did not complete successfully, re-run the action.

This problem is usually intermittent. Once connection issues have been resolved, retrying the action should succeed.

For example, if the function name is "cf_local_generated_1", change the block name to "cf_local_generated_1".

mc_soar_repo_edit_<repo_name>
mc_soar_repo_execute_<repo_name>
mc_soar_repo_view_<repo_name>

Once the appropriate roles are assigned to the user, they can run the actions/playbooks

See [1]

[2]

https://example-soar.com/rest/resource?page=X&sort=id

If using the phantom.get_tasks() or phantom.get_notes() playbook APIs, you can use phantom.requests instead to query the REST API directly:

# Instead of phantom.get_tasks(), use
url = phantom.build_phantom_rest_url('workbook_task')



# Or, instead of phantom.get_notes(), use
url = phantom.build_phantom_rest_url('note')

params = {'_filter_container': container['id'], 'page_size': 0, 'sort': 'id'}
response = phantom.requests.get(url, params=params)
tasks = response.json()['data']

• Keep the "Test Connectivity" window open and wait for the test to complete.
• Ignore the 500 "internal server error" and the "Failed to send" notification.

After you have viewed one asset configuration page, use one of the following workarounds to avoid the issue:

• Refresh the Password Vault browser page before selecting the Edit button for each asset you want to view.
• Remember the name of the asset you want to view. Select the Edit button for that asset to open its Apps page. The Asset field will be blank. Select the name of the asset you want to view.
• Right-click or Control-click the Edit button next to an asset to open it in a new tab.

If an asset in the "Assets with enabled password manager" table is empty, it is not available for use. It still exists in the table because a credential management field was deleted, preventing deletion of the asset from the table.

If you select Discard Changes before you have made any changes, the playbook code and JSON files are not changed.

Before you convert a playbook, spread out your playbook blocks so your connections are not close or overlapping. Then convert the playbook.

Review and test newly converted playbooks before marking them as active to ensure blocks and connectors appear and work correctly.

This helps us avoid OOMing in Django while preserving audit capability when performing a deletion thanks to a new pg trigger that was added.

In SOAR versions pre 6.3.0, customers running into an OOM when deleting a container with 1000+ artifacts should delete the container via a raw delete using the delete_db_containers management command. If this is a cloud customer, then SOAR on-call will need to delete the container for them with their permission.