Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot create ticket after SOAR platform update #138

Open
edthedev opened this issue Feb 6, 2025 · 0 comments
Open

Cannot create ticket after SOAR platform update #138

edthedev opened this issue Feb 6, 2025 · 0 comments

Comments

@edthedev
Copy link
Contributor

edthedev commented Feb 6, 2025

Context

It looks like Splunk has affected something in the new platform release of SOAR (6.3.1.176) that's causing the create TDX ticket action to fail with the following error:

'create_a_ticket_in_tdx'  on asset 'tdx-soar1' completed with status: 'failed'. Action Info: Size : 1.31 KB : [{"app_name":"Team Dynamix","asset_name":"tdx-soar1","param":{ ...redacted for ticket, see chat if needed... },"status":"failed","message":"handle_action exception occurred. Error string: ''notify''"}]

We think our current playbook is only still running because it was made on the old platform version and if you were to make a new playbook that ran that action it would likely throw the same error.

Possibly relevant:

https://docs.splunk.com/Documentation/SOAR/current/ReleaseNotes/WhatsNew

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.

and https://docs.splunk.com/Documentation/SOAR/current/ReleaseNotes/Enhancements#Deprecated_Features

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant