Known issues for Splunk SOAR (On-premises)

Release 6.4.1

Splunk SOAR version 6.4.1 includes the following known issues.

Date filed Issue number Description
2025-05-28PSAAS-23958Webhooks querystring parameters are parsed incorrectly
2025-05-19PSAAS-23626Playbook prompt blocks: Response is required, regardless of "Required" field setting
2025-04-16PSAAS-23000, PSAAS-22994Join Settings are not copied in copy paste
2025-04-01PSAAS-22727action_result.summary.responder_email datapath is not populated
2025-03-17PSAAS-22485Usernames containing commas (,) cause prompt block execution failures in playbooks
2025-01-16PSAAS-21440 VPE: Blocks in top right area of the canvas cannot be selected when there is an error messageWorkaround:Move the canvas to a location on your screen where blocks are not obscured by error messages.

To move the canvas, select a blank area of the canvas and drag it to another location on your screen.

2025-01-09PSAAS-21330VPE: Renaming the first action block makes it necessary to edit the next block.Workaround:This issue affects VPE blocks that have custom names where the name has been edited or changed.

To update playbooks where you have renamed a block or updated join settings follow these steps.

  1. Open the affected playbook.
  2. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings, or have renamed a block. Ensure that the join settings are configured appropriately.
  3. Save the playbook.
2024-02-22PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes
Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.