Splunk App for SOAR Export release notes

Welcome to release 8.6.x

What's new in this version of Splunk App for SOAR Export

Welcome to release 8.6.1

This patch for Splunk App for SOAR Export was released on October 14, 2026.

This patch addresses an issue with the following versions of Splunk App for SOAR Export (SASE) when run with with FIPS enabled in either Splunk Enterprise or Splunk Cloud Platform.

Affected SAS E release Install or update to
4.5.1 patch 8.6.1 or 8.7.1
8.6.0 patch 8.6.1 or 8.7.1
8.7.0 patch 8.7.1

If you are running SASE with FIPS enabled, upgrade to this patched version.

Refer to the updated prerequisites for this release and to the upgrade instructions.

Splunk Cloud Platform deployments:

Splunk Enterprise deployments:

Welcome to release 8.6

Important update

App version numbers

Starting with this release, Splunk App for SOAR and Splunk App for SOAR Exports version numbers are aligning with Splunk SOAR and Splunk Enterprise Security versions.

This version of Splunk App for SOAR Export was released on July 21, 2026 and includes the following enhancements.

Feature Description
Debug logging added
  • phantom_retry.log
  • phantom_phantomeventforwarding_modalert.log
  • phantom_sendtophantom_modalert.log
  • phantom_runphantomplaybook_modalert.log
  • phantom_configuration.log
Adaptive response action improvement Improved the alert action's SPL to detect associated finding-based detections when calling Send to SOAR or Run Playbook in SOAR.

Known issues in release 8.6

known issues for Splunk App for SOAR version 8.6

This version of Splunk App for SOAR Export has the following known issues. If there are no issues listed, there are currently no known issues in this release.

PAPP-38496

When run with FIPS enabled on either Splunk Enterprise or Splunk Cloud Platform, the following versions of Splunk App for SOAR Export (SASE) experience issues.

• 4.5.1

• 8.6.0

• 8.7.0

Symptoms might include Test Connectivity errors, settings that do not save, or events that are not forwarded to Splunk SOAR.

If you are running SASE with FIPS enabled, do not install or upgrade to one of the SASE versions listed here.

This issue is fixed in SASE 8.6.1 and 8.7.1. If you are running SASE with FIPS enabled, upgrade to a patched version.

Fixed issues in release 8.6

fixed issues in Splunk App for SOAR Export

This version of Splunk App for SOAR Export includes fixes to the following issues. If there are no issues listed, no issues were fixed.