SOAR - playbook not running when using Grouping in "Send to SOAR" action to send events to SOAR

Applicability

Description

When select Grouping “collect artifacts into one container” check box in the ‘Send to SOAR’ action, the events are being forwarded to SOAR, multiple artifacts are being created inside one container as expected. However, the playbook automation is not running.

Investigation

The issue is for Splunk App for SOAR Export version 4.3.22.

The cause is due to the total count of events is not correct from the search result and the run_automation parameter is never set as true when creating the last artifact. The playbook automation is not being triggered.

Resolution

On Splunk Enterprise

1. From Splunkbase, download Splunk App for SOAR Export | Splunkbase version 4.3.25.

2. Go to your Splunk Enterprise instance.

3. In the Apps panel, click the gear icon to manage apps.

4. Select Install app from file.

5. Select Upload App and upload the file obtained in Step 1.

6. Select the checkbox to upgrade the add-on. Making this selection overwrites the add-on you already downloaded.

7. Your Splunk Enterprise instance restarts to complete the upgrade.

On Splunk Cloud Platform

1. In Splunk Web, select Apps, then Manage Apps.

2. Find your app, then select Update Available to install the new version.