SOAR SMTP "send email" action sends from an unexpected sender when the "from" parameter is an empty string rather than absent

Applicability

Splunk SOAR (Cloud and On-premises) using the SMTP app "send email" action. Playbooks built in the Visual Playbook Editor (VPE) where the "from" parameter is intended to be left blank so the asset default applies. Environments where a "from" value was entered in the block and later removed in the editor.

Description

The "send email" action's optional "from" parameter is handled in two distinct ways depending on how the generated playbook code represents it:

• Absent key — the block was created without ever entering a "from" value. The generated Python contains no "from" key:

  parameters.append({
      "to": "recipient@example.com",
      "body": "test",
  })

  Result: the sender address configured on the SMTP asset is applied.

• Empty-string key — a "from" value was entered and then deleted in the VPE. The generated Python retains the key with an empty value:

  parameters.append({
      "to": "recipient@example.com",
      "body": "test",
      "from": "",
  })

  Result: default from-address resolution is applied instead of the asset's configured sender, which can send the message from an unexpected sender address.

A relevant editor limitation: once a "from" value has been populated and then cleared in the VPE, the empty "from" key may persist in the generated code. The "absent key" state can therefore be difficult to guarantee from the editor alone and may require rebuilding the block.

Investigation

1. Inspect the generated playbook code for the affected block. In the VPE, open the "send email" action block and review the generated Python parameters.append(...) dictionary.
2. Determine the "from" representation. Confirm whether the "from" key is absent or present as an empty string ("from": ""). An empty-string key is the condition associated with unexpected default sender resolution.
3. Confirm the asset's configured sender. Review the SMTP asset configuration to record the intended sender address that should apply when "from" is absent.
4. Capture debug output when reproducing. Run the block via the VPE Debugger (Test) and copy the debug logs for both a correct-sender result and an unexpected-sender result to compare the "from" value passed at execution.

Resolution

1. Rebuild the action block so the "from" key is absent. Re-create the "send email" block without entering any value in the "from" field, so the generated code contains no "from" key.
2. Verify in the generated code. Confirm the parameters.append(...) dictionary for the block does not include a "from" key (not even an empty string).
3. Alternatively, set "from" explicitly. To make the sender deterministic regardless of default resolution, populate "from" with the intended sender address rather than leaving it empty.
4. Re-test. Execute the block in the original run context and confirm the message is sent from the intended asset sender.

Revision History

Revision	Publish Date	Comments
1.0	01-Oct-2026	Initial Release