Configure Connectors for the Modern Splunk SOAR Automation Broker

configuring connectors for the Modern broker

You must configure connectors before the Splunk SOAR Automation Broker can connect to your assets to perform actions.

Set up a connector to use the Modern Splunk SOAR Automation Broker

set up connectors for Modern automation brokers

You must associate a connector with a Modern Splunk SOAR Automation Broker or modern broker group.

Note:

You cannot mix Modern and Classic Automation Brokers within the same asset. For details on Classic Automation Brokers, see Configure Connectors to use the Classic Splunk SOAR Automation Broker.

For details on asset configuration, see Add and configure apps and assets to provide actions in Splunk SOAR (Cloud) or Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) .

  1. In Splunk SOAR, select Home then Apps.
  2. Locate the connector that you want to configure.
    1. To edit a configured asset, select the arrow symbol ( ▶ ) labeled configured assets, then select the entry for the asset you want to edit.
    2. If you want to create a new asset for the connector, select the Configure New Asset button.
  3. Provide the information for the asset and ingest settings.
  4. In the custom settings, in the Automation Broker drop-down menu, select the name of the Modern Splunk SOAR Automation Broker or Modern broker group you want the connector to use.
  5. Select Save or continue entering information for this connector.

Set up environmental variables to apply to your connector configurations for Modern brokers

how to set up env variables for connectors

You can set up variables for your connector configurations in Splunk SOAR (Cloud) or Splunk SOAR (On-premises) deployment. These variables are applied on an individual connector's settings.

Set environment variables for a specific connector configuration

You can set up environment variables for a specific connector configuration. For example, add connector-specific proxy settings, or to create multiple connector configurations for multiple sites and Splunk SOAR Automation Broker instances.

  1. In Splunk SOAR (Cloud) or Splunk SOAR (On-premises), select Home then Apps.
  2. Locate the connector that you want to set up environment variables for.
  3. Follow the steps to create or modify a connector configuration. See Set up a connector to use the Modern Splunk SOAR Automation Broker.
  4. While editing the connector configuration, select the Asset Settings tab.
  5. Select Advanced.
  6. Select + Variable and add a new environment variable. If the variable is a password, certificate, or other secret, select the Secret checkbox.
  7. Select Save.

For example, if you have four different sites with different firewall configurations, install a Splunk SOAR Automation Broker at each site and set up four different connector configurations for the firewall connector, each one specifying different environment variables specific to the site settings.

Connector compatibility with Modern Automation Broker Groups

Some connectors are not compatible with Modern Automation Broker Groups. These connectors can be used with standalone Modern Automation Brokers.

Splunk-supported apps that are not compatible with groups

The following Splunk-supported apps cannot be used with Modern Automation Broker groups, but can be used with standalone Modern Automation Brokers.

  • AzureAD
  • AzureDevOps
  • CiscoWebex
  • FidelisNetwork
  • IMAP
  • Jira
  • Libraesva
  • Mattermost
  • MicrosoftAzureCompute
  • MicrosoftDefenderForEndpoint
  • MicrosoftIntune
  • MicrosoftTeams
  • MSADGraph
  • MSGraphForOffice365
  • MSGraphForOffice365Fed
  • MSGraphForSharePoint
  • Office365
  • Salesforce
  • Slack
  • SlackBot
  • SMTP

How to tell if an app is compatible with groups

Check your apps to see if they have any of the following elements within their code. Apps with any of these elements cannot be used with Modern Automation Broker groups, but can be used with standalone Modern Automation Brokers.

Code element Example
state filenames and state-path constants Reads the platform state file and writes answer files in APPS_STATE_PATH
custom state load/save helpers Uses save_app_state() and load_app_state()
direct JSON reads and writes Directly reads and writes JSON under paths.PHANTOM_APP_STATES.
application-state directory references Directly reads and writes JSON under paths.PHANTOM_APP_STATES. It uses the intended state directory but bypasses the state APIs.
state-file deletion Deletes, reads, and writes module-local OAuth state JSON.
OAuth completion and callback files Reads and writes module-local encrypted OAuth state JSON