Splunk SOAR (f.k.a. Phantom)

Can the Automation Broker be installed on a virtual machine?

shanto12
New Member

I was wondering if anyone has experience installing the AB on a virtual machine? Is this possible? What are the challenges faced if there are any? There is nothing in the doc about this. Thanks in advance.

Labels (1)
0 Karma

CS_
Path Finder

Yes you can. We have several Virtual servers running on ESXi, and we have broker docker containers running on them. The only issues we're experiencing is occasional errors in SOAR that say "Failed to communicate with Automation Broker" - which I think is a result of our corporate network more than anything else.

But as long as your VM can communicate with SOAR, I can't see any reason why a broker wouldn't work on the VM.

0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...