SOAR and Enterprise Security cannot communicate or pair after a new license is installed

Applicability

Description

After installing a new license, communication between Splunk Enterprise Security and Splunk SOAR may stop working.

Symptoms can include:

• ES and SOAR cannot be paired or unpaired successfully.
• ES account authentication with SOAR does not work as expected.
• Automation rules that depend on SOAR integration cannot operate correctly.
• Reattempting the pairing process does not resolve the issue.

The issue can occur when Enterprise Security retains an existing or inconsistent SOAR pairing state.

Investigation

On an on-premises Enterprise Security 8.2 or later Search Head, review the following configuration file:

$SPLUNK_HOME/etc/apps/missioncontrol/local/essoar.conf

Review the current values under the [pairing_state] and [pairing] stanzas.

For example:

[pairing_state]
pairing_attempt_id =
pairing_id =
pairing_status =[pairing]
pairing_completed_time =
soar_url =

If ES continues to retain pairing information even though the SOAR instance should be unpaired, the stale pairing state can interfere with a new pairing attempt.

Before performing configuration cleanup, confirm that the intended SOAR instance should be unpaired and that the existing pairing information is no longer required.

Resolution

Clear the existing SOAR pairing state and then attempt to pair Enterprise Security with SOAR again.

For on-premises Enterprise Security 8.2 or later, edit:

$SPLUNK_HOME/etc/apps/missioncontrol/local/essoar.conf

Clear or reset the pairing attributes as follows:

[pairing_state]
pairing_attempt_id =
pairing_id =
pairing_status = Unpaired[pairing]
pairing_completed_time =
soar_url =

After saving the configuration, reload or restart Splunk as appropriate for the environment.

Then initiate the ES-to-SOAR pairing process again.

In the reported case, clearing the existing SOAR pairing state allowed the customer to proceed with the integration, and no additional troubleshooting was required.