send to soar inactive in ACTION

[dragon]

Hello guys.

I'm having a problem right now.

SOAR : 192.168.100.120 (on-prem, Ver 7)

Splunk Enterprise : 192.168.100.128 (on-prem, Ver 10)

I'll tell you a few things I've done so far.

1. Install SOAR App, Connected to SOAR, Created Indexes

2. also, The connection test from SOAR to Enterprise also went smoothly.

3. user prev

However, when I set ‘Send to SOAR’ as an Action in Splunk, the button doesn't activate.

Did I miss anything?

[livehybrid]

HI @dragon 

Do you get anything if you run the following in SPL?

| rest /servicesNS/nobody/phantom/target_list_ar

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[dragon · Accepted solution]

no I dont have any results...

but I solved it. thanks

first. install both app (SOAR, SOAR EXPORT)

second. setting BOTH OF ALL...