Known issues for Splunk SOAR (On-premises)

Release 6.4.1

A list of known issues for SOAR on-premises 6.4.1.

Date filed Issue number Description
2025-08-12 PSAAS-24911 ES blocks fail when the finding does not exist on Splunk SOAR

Workaround: When using a `get finding or investigation` API in an ES playbook block, add an upstream ES block with `refresh finding or investigation` API.
2025-08-11 PSAAS-24865 Checking for app updates fails when an app has a non-Pythonic version number
2025-07-29 PSAAS-24656 Refresh finding or investigation returns 500 error

Workaround: No workaround exists.
2025-07-15 PSAAS-24475 pgbouncer logs are not written to the log file after logrotate
2025-07-09 PSAAS-24456 Random whois IP action fail
2025-07-07 PSAAS-24401 Script make_server_node.pyc has hardcoded user 'phantom' and fails with a different one
2025-06-16 PSAAS-24136 SOAR 6.4.X is using hardcoded path to /opt/phantom/etc/phantom_install.conf in start_phantom.sh
2025-06-11 PSAAS-24101 REGRESSION: VPE is not showing templates when configuring "promote to case" in Utility block

Workaround: After adding the promote to case utility block, edit the block's Python code. Update phantom.promote() to be:

phantom.promote(container=container, template=<workbook name>)

where workbook name is one of the workbooks listed in /admin/workbooks. Be sure to copy the name exactly. An example would look like this:

phantom.promote(container=container, template="Account Compromise")

Note that after making this change, the VPE will consider this to be custom code.
2025-05-28 PSAAS-23958 Webhooks querystring parameters are parsed incorrectly
2025-05-19 PSAAS-23626 Playbook prompt blocks: Response is required, regardless of "Required" field setting
2025-05-15 PSAAS-23555 SOAR 6.4.0 playbook debugger stuck in Status: Running!

Workaround: Contact Support
2025-04-16 PSAAS-23000, PSAAS-22994 Join Settings are not copied in copy paste
2025-04-01 PSAAS-22727 action_result.summary.responder_email datapath is not populated
2025-03-17 PSAAS-22485 Usernames containing commas (,) cause prompt block execution failures in playbooks
2025-01-16 PSAAS-21440 VPE: Blocks in top right area of the canvas cannot be selected when there is an error message

Workaround: Move the canvas to a location on your screen where blocks are not obscured by error messages.

To move the canvas, select a blank area of the canvas and drag it to another location on your screen.
2025-01-09 PSAAS-21330 VPE: Renaming a joined block causes the join settings to be invalid.

Workaround:To update playbooks where you have renamed a block or updated join settings follow these steps.

  1. Open the affected playbook.
  2. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings, or have renamed a block. Ensure that the join settings are configured appropriately.
  3. Save the playbook.
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround: Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.