Send to SOAR Failure from Mission Control

[zksvc]

Hi Everyone, 

I am experiencing an error when sending events from Mission Control to Splunk SOAR. I always get a failure when the send to SOAR action is automatically triggered through Adaptive Response.

Before I automated it, I tried to send event data from Mission Control to SOAR manually by clicking the three dots and then selecting 'Run Adaptive Response Actions' and everything went smoothly.

Has anyone ever experienced a similar problem?

Danke,
Zake

[LAME-Creations]

That has to be frustrating and I don't know if I have ever seen what you are experiencing.  I would try a couple things just to see if by chance a mistake has been made.  

1) This is what you said you already have done, but just validate that nothing has changed.  Try to send events manually to SOAR.  If they arrive, in theory the automated should work as well, but that does not seem to be your case.  Which leads me to 
1a)  I have actually done this.  I had set up two connections to my SOAR when I was setting it up.  One of the setups had the correct credentials to hit SOAR and the other did not.  So when I set up adaptive response and it says what configuration do you want to use (can't remember the exact verbiage of the question) I picked the wrong one from the dropdown and it caused failure to connect.  

2) When I started this, I had a clear idea what was my second thing I would try, but it slipped my mind as I wrote 1 and 1a.  But basically just verify that you really can manually send the alerts to SOAR and that you aren't able to send them as an adaptive response.  

[zksvc]

Hi @LAME-Creations 
When I send an event to SOAR manually, I get a difference such as user=admin and mode=adhoc. Whereas if I wait for adaptive response from mission control, it is mode=saved and user=machinename.

[zksvc]

Hi @LAME-Creations 

Thank you for the explanation, but when I tried to send the manual to SOAR, everything went well. Because I feel that the problem is not there, approximately which part should I check again ?