Known issues for Splunk SOAR (On-premises)
Release 6.3.0
Splunk SOAR version 6.3.0 includes the following known issues.
| Date filed | Issue number | Description |
|---|---|---|
| 2025-03-17 | PSAAS-22485 | Usernames containing commas (,) causing prompt block execution failures in playbooks |
| 2025-03-05 | PSAAS-22290 | Server side database connection terminations are not gracefully handled by add_to_searchindex |
| 2024-11-20 | PSAAS-20760 | Restarting phantom with telemetry off stops logs from being written to spawn.log |
| 2024-11-13 | PSAAS-20654 | Shutting down/restarting the system in a SOAR cluster without first shutting down SOAR caused ingestion intervals to be delayedWorkaround:Clear stale Ingestion status records from the database by running the following sql:
{noformat}UPDATE ingestion_status SET status='failed', task_state='finished' WHERE status='running' AND start_time < now() - Interval '24 hours';{noformat} The above will only mark records that are older than 24 hours as failed. Alternatively, disable polling on old assets and create new ones. |
| 2024-11-08 | PSAAS-20494, PSAAS-20496 | Multi-tenancy: Fail to run playbook configured with wildcard tenant (*) |
| 2024-11-06 | PSAAS-20435 | Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error |
| 2024-10-21 | PSAAS-20142 | VPE: Discarding changes doesn't reset the playbook editor for unconfigured action block |
| 2024-10-11 | PSAAS-20016 | SOAR Upgrade failure due to attempting to install SOAR when SOAR has already been installed |
| 2024-10-11 | PSAAS-20015 | 6.2.2 upgrade to 6.3.0 fails due to table "indicator_artifact_record_archive" already existing |
| 2024-10-04 | PSAAS-19942 | /opt/phantom/var/log/nginx/error.log is hard coded in config leads to error: No such file or directory |
| 2024-10-02 | PSAAS-19917, PSAAS-20071 | Reports page drop down results in 500 Server ErrorWorkaround:You can work around this issue by changing your user settings for SOAR.
|
| 2024-09-25 | PSAAS-19798 | VPE: Action block not updating certain actions after unconfiguringWorkaround:Add a new action block and reconfigure |
| 2024-09-24 | PSAAS-19708 | Playbooks might remain in pending status |
| 2024-09-12 | PSAAS-19457 | phantom.get_notes() fails with "failed to retrieve note Error: That page contains no results" when number of notes is multiple of page size |
| 2024-09-10 | PSAAS-19362 | Placeholder values for custom indexes in the Forwarder Settings modal don't match the actual default indexes |
| 2024-08-09 | PSAAS-18994 | Intermittent issues dragging new block connections |
| 2024-08-09 | PSAAS-18993 | VPE creates join function between blocks with no callbacks, resulting in functions being called twice |
| 2024-07-31 | PSAAS-18866, PSAAS-19037 | No redirection or toast if two tabs opened |
| 2024-06-24 | PSAAS-18174 | VPE: Error message "'NoneType' object has no attribute 'scm_id'" on first playbook save |
| 2024-04-17 | PSAAS-17305 | REST APIs with pagination give a 400 error |
| 2024-03-25 | PSAAS-16959 | Enabling the Secret Flag in Global Environment Variables Causes Automation Broker Test Connectivity/Poll Now to FailWorkaround:Remove the secret flag from all global environment variables for Test Connectivity to work with AB. |
| 2024-03-13 | PSAAS-16695 | VPE: Action block using Splunk app marked unconfigured when optional parameters not specified |
| 2024-03-06 | PSAAS-16642 | VPE: Deleting conditions from a filter block changes the conditions for downstream blocks instead of deleting themWorkaround:If you have already deleted multiple conditions in the filter block configuration panel:
If you have multiple condition labels on the connections downstream from the filter block, check to see if the labels match the conditions you specified in the filter block configuration panel.
|
| 2024-02-22 | PSAAS-16477 | Podman does not currently work with redirected image URLs due to Docker Hub authentication token changesWorkaround:Manually change the image: line in docker-compose.yaml to point to |
| 2024-01-30 | PSAAS-16206 | Global Environment Variables are incorrectly applied by the Automation Broker when the variable is named as all lowercase lettersWorkaround:Use uppercase letters only. |
| 2023-08-25 | PSAAS-14609 | Automation Broker: Broker status should be updated if the broker directory is no longer present |
| 2022-02-03 | PSAAS-7499 | VPE: Playbook name field should be longer |