SOAR - Splunk App for SOAR Export timed out connecting to SOAR

Applicability

Description

There was an error adding the server configuration.

On SOAR: Verify server's 'Allowed IPs' and authorization configuration. Failed to communicate with user "" on SOAR server "https://<SOAR IP>:8443". Error: Httpsconnectionpool(host='<SOAR IP>', port=8443): max retries exceeded with url: /rest/user_settings (caused by sslerror(sslerror(1, '[ssl: sslv3_alert_handshake_failure] sslv3 alert handshake failure (_ssl.c:1161)')))

Investigation

Here is additional OS information from Splunk Search Head and SOAR: 

Search Head:
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL=https://amazonlinux.com/
SUPPORT_END="2026-06-30"

Search Head doesn't have FIPS enabled:

$ cat /proc/sys/crypto/fips_enabled
0

SOAR OS information:

SOAR:
NAME="Amazon Linux"
VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023.7.20250414"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL=https://aws.amazon.com/linux/amazon-linux-2023/
DOCUMENTATION_URL=https://docs.aws.amazon.com/linux/
SUPPORT_URL=https://aws.amazon.com/premiumsupport/
BUG_REPORT_URL=https://github.com/amazonlinux/amazon-linux-2023
VENDOR_NAME="AWS"
VENDOR_URL=https://aws.amazon.com/
SUPPORT_END="2029-06-30"

SOAR has FIPS enabled.

$ cat /proc/sys/crypto/fips_enabled
1

Resolution

The issue was being reproduced using the same Splunk Enterprise and SOAR OS and FIPS configuration.  The following solutions are tested successfully:

1. If you cannot enable FIPS in Splunk SH, you need to use SOAR without FIPS.

2. If you can enable FIPS in Splunk SH, you need to enable FIPS. Both 140-2 and 140-3 should work with SOAR.