Welcome to Splunk SOAR (On-premises) 7.0.0

The Splunk SOAR (On-premises) platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools to help you orchestrate security workflows, automate repetitive security tasks, and quickly respond to threats.

If you are new to Splunk SOAR (On-premises), read About Splunk SOAR (On-premises) in the Use Splunk SOAR (On-premises) manual to learn how you can use Splunk SOAR (On-premises) for security automation.

If your Splunk SOAR (On-premises) deployment uses the Splunk SOAR Automation Broker see What's new in Splunk SOAR Automation Broker in the Set up and manage Splunk Automation Broker documentation.

Documentation for earlier versions of Splunk SOAR (On-premises)

Where to find older versions of docs that aren't on the new help portal yet.

We are in the process of moving all versions of Splunk SOAR (On-premises) to this new documentation portal. In the interim, you can reach previous documentation versions in the docs.splunk.com portal. Follow this link to documentation for Splunk SOAR (On-premises) version 6.0.1. From there, use the version selector tool to view documentation for other versions. If you select a version that is already in the new documentation portal, you will be automatically redirected to the new portal.

September 18, 2025 Release 7.0.0

list of enhancements found in Splunk SOAR (on-premises) version 7.0.0

Important updates

Python version update

Python 3.13 support is now available across Splunk SOAR, helping you stay ahead of the upcoming end-of-life of Python 3.9.

In Splunk SOAR (on-premises) 7.0.0, both Python 3.9 and Python 3.13 are supported. Your automation code in Apps and Playbooks will be automatically migrated to Python 3.13 when your deployment is upgraded. If any of your Python code is not able to be migrated, your automation code remains on Python 3.9. You can see errors in the respective editor for the automation type (playbooks, custom functions, and apps).

For more information, see How Splunk SOAR (On-premises) uses Python, in Administer Splunk SOAR (On-premises).

Action required: Automation Broker update required

You must update your Automation Broker to release 7.0.0 or higher if all three of the following conditions exist in your organization:

Your organization uses a credentials manager, such as Hashicorp Vault, or Thycotic Secret Server, and
You have apps or assets that use an Automation Broker, and
The app or asset that uses an Automation Broker has been migrated to Python 3.13

Note: If you do not update the Automation Broker, app or asset actions will fail because they will not be able to authenticate using your organization's credentials manager.

To learn how to update your Splunk Automation Broker, see September 18, 2025 Release 7.0.0 in the Splunk SOAR Automation Broker documentation.

What's new in Splunk SOAR (On-premises)

This release of Splunk SOAR (On-premises) includes the following enhancements.


Splunk Idea	Feature	Description
	Improved SOAR app development with the new Splunk SOAR SDK	The new Splunk SOAR SDK streamlines the SOAR app development process. For details, see Develop an app using the Splunk SOAR SDK.
	Pairing of Splunk Enterprise Security and Splunk SOAR	Hybrid pairing: You can now pair a single Splunk SOAR (On-premises) instance with Splunk Enterprise Security (Cloud). For details, see the Splunk SOAR Compatibility Matrix in the Splunk Enterprise Security documentation and Pair Splunk SOAR (On-premises) with Splunk Enterprise Security. Pairing improvements: Updates for greater efficiency and flexibility of pairing Splunk Enterprise Security with Splunk SOAR. For details about pairing from the Splunk SOAR side, see Pair Splunk SOAR (On-premises) with Splunk Enterprise Security.
PPSID-I-608 PPSID-I-362	The new Event page date filter provides a streamlined view of Events for all users	Focus on specific Event data by using the date filter to display preset date ranges like Last 24 hours, Last 7 days, Last 30 days, or custom date ranges that you define. For admin information, see Manage display preferences for the Events page in the Administer Splunk SOAR (On-premises) documentation. For user information, see Open the Investigation page in the Use Splunk SOAR (On-premises) documentation.
PPSID-I-481	Python 3.9 to 3.13 support	Python 3.13 support is now available and Python 3.9 support will soon end. For details, see How Splunk SOAR (On-premises) uses Python.
PPSID-I-238 PPSID-I-652	IPv6 support	Splunk SOAR (On-premises) now has support for IPv6. For detailed information, see Support for IPv6 in Splunk SOAR (On-premises). The latest versions of Splunk SOAR Automation Broker (v 7.0.0), Splunk App for SOAR (v 1.0.72) and Splunk App for SOAR Export (v 4.3.26) also support IPv6.
	Automation dependencies	Automation dependencies describe which Python version your playbooks and custom functions use for automation. You can create your own dependencies for custom playbooks and custom functions. For details, see Manage automation dependencies in the Administer Splunk SOAR (On-premises) manual.
	Consolidated automation engine	Behind the scenes, the ActionD component has been consolidated into DecideD to simplify the automation engine and improve stability, resulting in 63% decrease in action execution time for actions with low I/O requirements. ActionD has been removed from the System Health dashboard as part of this consolidation. See Monitor the health of your Splunk SOAR (On-premises) system.

This version of Splunk SOAR now uses Splunk Universal Forwarder version 10.0.0.