Welcome to Splunk SOAR (On-premises)
The Splunk SOAR (On-premises) platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools to help you orchestrate security workflows, automate repetitive security tasks, and quickly respond to threats.
If you are new to Splunk SOAR (On-premises), read About Splunk SOAR (On-premises) in the Use Splunk SOAR (On-premises) manual to learn how you can use Splunk SOAR (On-premises) for security automation.
If your Splunk SOAR (On-premises) deployment uses the Splunk SOAR Automation Broker see What's new in Splunk SOAR Automation Broker in the Set up and manage Splunk Automation Broker documentation.
Documentation for earlier versions of Splunk SOAR (On-premises)
Where to find older versions of docs that aren't on the new help portal yet.
We are in the process of moving all versions of Splunk SOAR (On-premises) to this new documentation portal. In the interim, you can reach previous documentation versions in the docs.splunk.com portal. Follow this link to documentation for Splunk SOAR (On-premises) version 6.0.1. From there, use the version selector tool to view documentation for other versions. If you select a version that is already in the new documentation portal, you will be automatically redirected to the new portal.
November 4, 2026 Release 8.8
enhancements found in this Splunk SOAR (On-premises) release
What's new in Splunk SOAR (On-premises)
| Splunk Idea | Feature | Description |
|---|---|---|
| Automation Broker High Availability |
Create groups of Automation Brokers for high availability and scalability. Within each group, if one broker goes offline, traffic automatically switches to active brokers. Add brokers to a group to scale for higher loads and distribute work across them. For details, see About Splunk SOAR Automation Broker. Available for
|
|
| PPSID-I-520 | System Insights enhancements | System insights now includes information on SOAR custom functions and SOAR Automation Brokers. For details, see Use system insights in the Use Splunk App for SOAR documentation. |
Custom functions: As of Splunk SOAR version 8.8.0, names, descriptions, and other metadata combined must be less than 512 KiB. This limit does not apply to runtime arguments or execution results and does not affect oversized metadata in custom functions created before 8.8.0.
For details on custom functions, see Add custom code to your Splunk SOAR playbook with a custom function in the Build Splunk SOAR playbooks documentation.