Known issues for Splunk SOAR (On-premises)

Release 6.4.1

A list of known issues for SOAR on-premises 6.4.1.


Date filed	Issue number	Description
2025-08-12	PSAAS-24911	ES blocks fail when the finding does not exist on Splunk SOAR Workaround: When using a `get finding or investigation` API in an ES playbook block, add an upstream ES block with `refresh finding or investigation` API.
2025-08-11	PSAAS-24865	Checking for app updates fails when an app has a non-Pythonic version number
2025-07-29	PSAAS-24656	Refresh finding or investigation returns 500 error Workaround: No workaround exists.
2025-07-15	PSAAS-24475	pgbouncer logs are not written to the log file after logrotate
2025-07-09	PSAAS-24456	Random whois IP action fail
2025-07-07	PSAAS-24401	Script make_server_node.pyc has hardcoded user 'phantom' and fails with a different one
2025-06-16	PSAAS-24136	SOAR 6.4.X is using hardcoded path to /opt/phantom/etc/phantom_install.conf in start_phantom.sh
2025-06-11	PSAAS-24101	REGRESSION: VPE is not showing templates when configuring "promote to case" in Utility block Workaround: After adding the `promote to case` utility block, edit the block's Python code. Update `phantom.promote()` to be: `phantom.promote(container=container, template=<workbook name>)` where workbook name is one of the workbooks listed in `/admin/workbooks`. Be sure to copy the name exactly. An example would look like this: `phantom.promote(container=container, template="Account Compromise")` Note that after making this change, the VPE will consider this to be custom code.
2025-05-28	PSAAS-23958	Webhooks querystring parameters are parsed incorrectly
2025-05-19	PSAAS-23626	Playbook prompt blocks: Response is required, regardless of "Required" field setting
2025-05-15	PSAAS-23555	SOAR 6.4.0 playbook debugger stuck in Status: Running! Workaround: Contact Support
2025-04-16	PSAAS-23000, PSAAS-22994	Join Settings are not copied in copy paste
2025-04-01	PSAAS-22727	action_result.summary.responder_email datapath is not populated
2025-03-17	PSAAS-22485	Usernames containing commas (,) cause prompt block execution failures in playbooks
2025-01-16	PSAAS-21440	VPE: Blocks in top right area of the canvas cannot be selected when there is an error message Workaround: Move the canvas to a location on your screen where blocks are not obscured by error messages. To move the canvas, select a blank area of the canvas and drag it to another location on your screen.
2025-01-09	PSAAS-21330	VPE: Renaming a joined block causes the join settings to be invalid. Workaround:To update playbooks where you have renamed a block or updated join settings follow these steps. Open the affected playbook. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings, or have renamed a block. Ensure that the join settings are configured appropriately. Save the playbook.
2024-02-22	PSAAS-16477	Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes Workaround: Manually change the `image:` line in docker-compose.yaml to point to `docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.`