Create a Modern Splunk SOAR Automation Broker

how to create a new, modern Splunk SOAR Automation Broker

Note: If your container host cannot connect to Docker Hub, due to access limitations or policy reasons, get the Splunk SOAR Automation Broker image manually. Use the instructions in Set up the Splunk SOAR Modern Automation Broker manually.

If you are not the Splunk SOAR Administrator, work with the Splunk SOAR Administrator to complete these steps.

You must create at least one single modern Automation Brokers before you can create a group of modern Automation Brokers.

Modern Automation Brokers that are not included in a group are called single or standalone brokers.

To create an individual modern Automation Broker, follow these steps:

Before you begin, navigate to the Add Automation Broker page:

  1. Within Splunk SOAR, from the Home menu, select Administration, then Product Settings, then Automation Broker (Modern).

  2. Select +Modern broker.

Follow the instructions on the page, also detailed here with numbers corresponding to the steps on the page.

Step 1: Install and configure Docker Compose for your local environment. For details, see Overview of installing Docker Compose on the Docker website.

Step 2: On the Add Automation Broker page, select Generate to generate a configuration file (docker-compose.yml) and registration key (broker_registration.key) files. Download both generated files.

Step 3: Copy the docker-compose.yml file to the directory you will use for your broker (for example, /MyBrokers/Broker1/docker-compose.yml). Edit this copy of the file, changing the environment variables as needed for your local environment. Use the following table and follow the instructions provided within the docker-compose.yml file comments.

Note:

Do not change the /splunk_data container path or runtime socket container path.

If you are using Podman, see the section after the table.

Table 1. Compose file settings
Setting Required? Description
SOAR_BASE_URL Required Splunk SOAR base URL used by Broker Manager and Automation Broker.
DOCKER_HOST Required Runtime endpoint used by Broker Manager,

If you are using Docker, usually unix:///var/run/docker.sock

If you are using Podman, usually

unix:///var/run/podman.sock

.
AB_IMAGE Optional Automation Broker image repository. Default: splunk/soar-broker
VERSION Optional

Automation Broker image tag override.

If VERSION is set in this compose file, The Broker Manager writes that value to splunk_data/VERSION on startup.

Editing this value while Broker Manager is running, can change the target Automation Broker version on the next update check.
PUID/PGID Optional File ownership used for broker data.
http_proxy/https_proxy Optional

Outbound proxy settings for HTTPS traffic.

If you are using IPv6, addresses must be surrounded by square brackets, for example [2001:db8:3333:4444:5555:6666:7777:8888]
HEALTH_CHECK_SCHEDULE Optional Automation Broker health-check schedule. Default: every 10 minutes.
UPDATE_CHECK_SCHEDULE Optional Broker update-check schedule. Default: every 5 minutes.
Table 2. Bind mounts
Volume mount type Description
Splunk data Automation Broker persistent data storage; same for Docker and Podman
Socket bind

How Splunk runs Automation Broker commands within your container.

Use the bind mount appropriate for your container runtime.

Docker users: No action required. Configuration is set up for Docker by default.

Podman users: In the compose file, find the bind section, shown here. Uncomment the podman lines and comment out the docker lines. You might also need to change the user from the default value of 1000.
CODE 
- type: bind
source: /var/run/docker.sock 
target: /var/run/docker.sock
# - type: bind
#   source: /run/user/1000/podman/podman.sock  
#   target: /var/run/podman.sock

Step 4: Create a directory named splunk_data at the path listed in your Docker Compose file. Copy the broker_registration.key file you downloaded into that directory.

CODE 
broker-manager/
   splunk_data/
    ab_1/
      broker_registration.key

Step 5: From the directory containing the Docker Compose file and splunk_data, run the following command to start the broker.

CODE 
docker compose up -d

When the broker first starts, it will delete the registration key file in its splunk_data directory.

To verify the Broker Manager runs and is functioning correctly, run the following command:

CODE 
docker ps 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

Expected results:

  • The Broker Manager runs.

  • The Automation Broker name begins with this format <current_folder>-<broker-manager-name>_ab_1.

  • The Automation Broker appears in Splunk SOAR after pairing and AMQP connectivity is complete.

Step 6: After you have finished creating brokers, delete any extra copies of the original files you downloaded in Step 2.

Step 7: Select Complete to return to the Automation Broker page and verify the new brokers you started are listed.