Known issues for Splunk SOAR (On-premises)

Release 7.1.0

Splunk SOAR (On-premises) known issues for release 7.1.0

Date filedIssue numberDescription
2025-11-28PSAAS-26404

Upgrading a SOAR cluster that's using IPv6 for cross-node communication fails on RabbitMQ failing to start.

2025-11-18PSAAS-26327

Internal Server Error when trying to open any playbook in Firefox

Workaround: Use Chrome browser

2025-11-14PSAAS-26304

VPE debugger: Cannot select Scope

Workaround: When you select All artifacts or New artifacts, your selection is applied, although it does not appear in the menu. When you select Artifact, the artifact selection field is not where expected, but still functions correctly.

2025-11-14PSAAS-26301

SOAR UI user prompts render blank screen

Workaround: Select individual notifications from the notification (bell) icon next to your username at the top of the screen.

2025-11-12PSAAS-26263

"Ingestion Errors" table in Administration, and the "rest/ingestion_status" API, show all timestamps as the current time for all ingestion events

Time-based filters on the ingestion_status API and "Ingestion Errors" table are still respected, as the timestamps in the database are correctly recorded. For example, this query parameter:/rest/ingestion_status?filter_start_time_gte="2025-11-12T17:58:29.998Z" still correctly returns ingestion_status events which started after 2025-11-12T17:58:29.998Z, but the timestamp fields in the event responses will be incorrect

2025-11-07PSAAS-26168Visual Playbook Editor debugger: Playbook Run hangs despite successful completion
2025-11-05PSAAS-26131"SOARFoundationsUpdateUsers" does not get migrated to "UpdateEnterpriseSecurityUsers" when upgrading past 6.4.0
2025-10-30PSAAS-26072

Playbook/Custom Function migration from 3.9 to 3.13 does not generate audit trail

Logs for the automation migration task showing what automation was moved (or not moved and why) to Python 3.13 can be viewed in the <PHANTOM_HOME>/var/log/phantom/automation_migration.logfile.