Splunk App for SOAR Export Not Sending Events to Splunk SOAR With Connection TimeOut Error.

Applicability

Description

Splunk App for SOAR not able to communicate with Splunk SOAR OnPrime Machine.

Investigation

While investigating found that Splunk SOAR OnPrem is successfully communicating with Splunk Cloud but reverse was being failed and to troubleshoot this issue ran below query,

SPL:

index=_internal *phantom_reporting* log_level=Error

ERRORS:

Error log 1:

Traceback (most recent call last):
File "/opt/splunk/etc/apps/phantom/bin/phantom_rest.py", line 237, in handle_POST
contains, cef_metadata = pi.verify_server()
File "/opt/splunk/etc/apps/phantom/bin/phantom_instance.py", line 489, in verify_server
raise Exception(message)
Exception: HTTPSConnectionPool(host='192.132.225.106', port=8090): Max retries exceeded with url: /rest/ph_user?include_automation=true&_filter_token__key='<token>' (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x7f2b8e948350>, 'Connection to xxx.xxx.xx.xx timed out. (connect timeout=15)'))

Error log 2:

024-05-08 18:44:15,235 ERROR phantom_forward:195 - Traceback (most recent call last):
File "/opt/splunk/etc/apps/phantom/bin/scripts/phantom_forward.py", line 190, in <module>
forward_csv(config, search_name, csv_path)
File "/opt/splunk/etc/apps/phantom/bin/scripts/phantom_forward.py", line 79, in forward_csv
raise Exception('Cannot find search target ({}) in server configurations'.format(search['_target']))
Exception: Cannot find search target (f753327e-176b-42c7-a8ce-a3d8585c71fb) in server configurations

This Error logs indicates that Splunk Cloud and Splunk OnPrem SOAR is not able to communicate with each other due to network issues.

Resolution

Allow Splunk Cloud IP via network level firewall to communicate with Splunk OnPrem Cloud, This documentation will help to allow OnPrem IPs to white-list on Splunk Cloud.