"Ingestion Errors" table in Administration, and the "rest/ingestion_status" API, show all timestamps as the current time for all ingestion events

Workaround:

Time-based filters on the ingestion_status API and "Ingestion Errors" table are still respected, as the timestamps in the database are correctly recorded. For example, this query parameter:

/rest/ingestion_status?_filter_start_time__gte="2025-11-12T17:58:29.998Z"

still correctly returns ingestion_status events which started after 2025-11-12T17:58:29.998Z, but the timestamp fields in the event responses will be incorrect

SHA-512 checksums verification returns warning

Workaround: Downloaded the .sha512 file. Complete the following steps before running the the sha512sum -c command:

Generate a SHA-512 checksum for <soar_package_tar_file> using the command shasum -a 512 <soar_package_tar_file>. Then, compare the generated checksum with the hash provided in the downloaded .sha512 file to confirm they match.

Investigation page: Run Playbook button in Workbook tab is not clickable

Workaround: Use the Chrome browser. This issue does not exist when using Chrome.

Adding else-if statement in existing playbook deletes previously configured else-if statement

Workaround: Before adding a new else-if condition to an existing decision or filter block, follow these steps

1. Make a backup copy of the existing decision or filter block. (Select the original block. Press Cmd/Ctrl+C then Cmd/Ctrl+V to create a copy and paste it on the canvas.)

2. Add the new condition to the original block. If any existing conditions are erased, delete both the new and erased conditions. Refer to the backup block to reconfigure the missing data.

3. Delete the backup block.

VPE: Utility block - API config info appears deleted when selecting different utility block

Workaround: Data is not deleted, but is not displayed. To display the utility block data again, click anywhere on the VPE canvas. Then select the original utility block to confirm that data displays correctly.

ES blocks fail when the finding does not exist on Splunk SOAR

Workaround: When using a `get finding or investigation` API in an ES playbook block, add an upstream ES block with `refresh finding or investigation` API.

Events Display Preferences: non-admin users can toggle default lookback dropdown

Workaround: Only SOAR Administrators can update the default lookback value under Administration > Event Settings > Display Preferences. Users without admin permissions must contact an admin to update this setting.