Troubleshooting System Email Notification Failures in Splunk SOAR Cloud

Applicability

Description

In the Splunk SOAR Cloud environment, email traffic is categorized into two distinct types: playbook-executed emails and system-level notification emails. Playbook-driven emails can successfully utilize external or on-premises SMTP brokers. Conversely, system-level notification emails—managed via the administrative settings—are required to originate from the cloud instance itself. Configuring an on-premises SMTP forwarder in these specific administrative settings will cause system notifications to fail silently.

Investigation

1. Determine if playbook-driven emails are being delivered successfully.
2. Verify if system-level email notifications (e.g., administrative alerts or health notifications) are failing.
3. Review the current configuration under the administrative email settings page. If an external or on-premises automation broker is designated as the primary SMTP provider for system-level mail, the configuration is incompatible with cloud-native system notification requirements.

Resolution

1. Navigate to the Administration>Email Settings interface for email configuration.
2. Ensure that the default email settings are not configured to point to an on-premises SMTP broker unless that broker is specifically designed to be internet-accessible and compatible with the cloud instance's requirements.
3. If an on-premises SMTP forwarder is being used for general playbook traffic, it should be scoped to the specific playbook action rather than global system settings.
4. Revert system-level SMTP settings to the default configuration to ensure consistent delivery of administrative and system alerts.

Related Links

Splunk SOAR Documentation: Migrate Splunk SOAR On-Premises Administration Settings to Splunk SOAR Cloud