SOAR - Splunk App for SOAR Export cannot save Event Forwarding events

Applicability

Description

1. Navigate to Server configuration within the app SAS Export

2. Create a server configuration

3. Proceed to the "Event Forwarding" section.

4. Create a new event forwarding configuration.

5. Provide the required details such as target, severity, sensitivity, etc.

6. Attempt to save the event forwarding configuration.

Upon attempting to save the event forwarding configuration, the following error message is displayed: "dictionary keys changed during iteration". 

Investigation

During debugging it was found the phantom_rest.py is using the python 3.9.17. Earlier Splunk version was using the python 3.7 so the issue was not faced earlier.

$ splunk/bin/python -V Python 2.7.18.6 
$ splunk/bin/python2 -V Python 2.7.18.6 
$ splunk/bin/python3 -V Python 3.9.17

As per python doc, In python 3.8.18 onwards,

In that python Changing dict keys during iteration of the dict itself, keys(), values(), or items() will now be detected in certain corner cases where keys are deleted/added so that the number of keys isn't changed. A RuntimeError will be raised after len(dict) iterations.

Resolution

The issue is fixed in Splunk App for SOAR Export 4.3.13 version. Download and upgrade to the version from the link:

Splunk App for SOAR Export | Splunkbase