Changelog - Splunk SOAR SDK 7.1.1 documentation

SDK 7

7.1.1 (2026-11-02)

Fix: Raise SDK app dependency minimums for cryptography, Click, setuptools, Soup Sieve, PyJWT, Authlib, joserfc, and AnyIO. [PSAAS-36009, PSAAS-36010, PSAAS-36011, PSAAS-36012, PSAAS-36013, PSAAS-36014, PSAAS-36015, PSAAS-36016, PSAAS-36473, PSAAS-36474, PSAAS-33721, PSAAS-33720, PSAAS-33690, PSAAS-33689, PSAAS-33688, PSAAS-33687, PSAAS-33686, PSAAS-33685, PSAAS-33669, PSAAS-33668, PSAAS-36956, PSAAS-36954, PSAAS-36955, PSAAS-36831, PSAAS-36951, PSAAS-36868, PSAAS-36869, PSAAS-36472, PSAAS-36957, PSAAS-36841, PSAAS-36913]

7.1.0 (2026-10-31)

Feature: Allow view handlers to request optional params and summary lists aligned with their output rows.

7.0.3 (2026-10-23)

Fix: Avoid decrypting sensitive action parameters twice when the native SOAR or automation broker BaseConnector has already decrypted them.

7.0.2 (2026-10-21)

Fix: Decrypt Param(sensitive=True) action parameters before passing them to the action function when enable_action_parameter_encryption is set by the platform.

7.0.1 (2026-10-20)

Fix: Verify SOAR API TLS certificates by default when apps run off platform.

7.0.0 (2026-10-19)

Breaking changes:

Feature: Breaking: Replace Python 3.14 support with Python 3.15, retaining Python 3.13. SDK imports load lazily on Python 3.15 and remain eager on Python 3.13. Update app Python requirements to >=3.13, <3.16, !=3.14.*, replace explicit 3.14 targets and uv environments with 3.15, run uv lock --upgrade for compatible dependency wheels, and rebuild the app. The PY_3_14 enum, resolve_py314 method, and pip314_dependencies manifest field are replaced by their 3.15 equivalents.

SDK 6

6.1.5 (2026-10-14)

Fix: Keep leading HTML comments from hiding custom views in container timelines.

6.1.4 (2026-10-13)

Fix: Updated dependencies.

6.1.3 (2026-10-02)

Fix: Build webhook URLs without action configuration and raise a clear error when the app directory cannot be determined.

6.1.2 (2026-09-30)

Fix: Allow native SOAR apps to connect to the local REST endpoint when its certificate covers the stack DNS name instead of 127.0.0.1.

6.1.1 (2026-09-22)

Fix: Make custom template JSON filters safe for JavaScript contexts.

6.1.0 (2026-09-21)

Docs: Publish Markdown pages and an llms.txt index with the SDK documentation, and validate the generated docs strictly in CI. Written by Codex.

6.0.1 (2026-09-19)

Fix: Describe the secure verify_ssl default accurately in generated app metadata and documentation.

6.0.0 (2026-09-19)

Breaking changes:

Fix: Breaking: Verify SSL certificates by default for MakeRequestParams; set verify_ssl=False explicitly when connecting to endpoints with self-signed certificates.

SDK 5

5.0.1 (2026-09-18)

Docs: Document the SDK release history and CI-managed changelog workflow.

5.0.0 (2026-09-15)

Breaking changes:

Fix: soarapps install now verifies TLS certificates by default. Deployments using self-signed or otherwise untrusted certificates must install a trusted certificate or pass --insecure explicitly.
Fix: SDK HTTP clients now honor the platform TLS verification setting when creating and refreshing connections. Deployments that relied on disabled certificate verification must configure the platform and certificates accordingly.

SDK 4

4.4.2 (2026-09-15)

Fix: Set Splunk SOAR 8.9.0 as the minimum version for apps that use Python script asset fields.

4.4.1 (2026-09-09)

Fix: Refresh project dependencies.

4.4.0 (2026-09-09)

Feature: Add support for Python script asset fields in asset models and manifests.

4.3.0 (2026-09-09)

Feature: Add a validated host type for networking fields.
Docs: Update the repository branding and documentation assets.

4.2.1 (2026-09-09)

Fix: Allow pythonwhois-alt to build from source when a compatible wheel is unavailable.

4.2.0 (2026-09-08)

Feature: Add provenance metadata to generated SDK manifests.

4.1.2 (2026-08-21)

Fix: Asset-state force reload behavior on modern Automation Broker versions.

4.1.1 (2026-08-21)

Fix: Asset-state handling when encryption helpers are unavailable or perform no operation.
Fix: Restrict asset-state encryption changes to remote procedure call (RPC) brokers.
Docs: Clarify that encryption at rest is provided by Splunk SOAR.

4.1.0 (2026-08-21)

Feature: Add the --lean option to soarapps init for smaller app scaffolds.

4.0.0 (2026-08-15)

Breaking changes:

Fix: Actions that omit read_only now default to non-read-only and are not eligible for Safe Mode. Apps that rely on Safe Mode must set read_only=True for every action that only reads data; actions that modify external systems must remain non-read-only.

SDK 3

3.29.0 (2026-08-11)

Feature: Add phantom.cef and phantom.utils compatibility shims for legacy apps.

3.28.1 (2026-08-06)

Fix: Preserve artifacts when polling retries a duplicate container.

3.28.0 (2026-08-05)

Feature: Add support for external credential management.

3.27.2 (2026-08-03)

Fix: Improve polling reliability by saving checkpoints after durable writes, failing when container saves fail, and preserving duplicate-container behavior.
Fix: Limit MIME-part traversal during email processing.

3.27.1 (2026-08-03)

Fix: Validate IPv6 indicators extracted from email data.
Fix: Avoid selecting a malformed Authlib release during dependency resolution.

3.27.0 (2026-08-03)

Feature: Add complete action-lock metadata, including a lock data path and timeout.
Feature: Deprecate enable_concurrency_lock. Use lock=ActionLock(...) when an action requires exclusive locking.

3.26.5 (2026-08-03)

Fix: Update dependencies and test tooling.

3.26.4 (2026-07-29)

Fix: Update dependencies and pre-commit automation.

3.26.3 (2026-07-22)

Fix: Improve email processing failure handling, including recursive parsing, inline body aggregation, and artifact saves.

3.26.2 (2026-07-20)

Fix: Constrain Rich to versions below 15 for compatibility.

3.26.1 (2026-07-17)

Fix: Expand email URL extraction.
Fix: Validate OAuth callback state.

3.26.0 (2026-07-13)

Feature: Improve on_es_poll performance by parallelizing container and attachment writes.

3.25.4 (2026-07-07)

Fix: Update idna to address a known security vulnerability.

3.25.3 (2026-07-07)

Fix: Refresh dependency locks.

3.25.2 (2026-07-02)

Fix: Correct SDK documentation links.

3.25.1 (2026-06-22)

Fix: SDK app behavior on modern Automation Broker versions.

3.25.0 (2026-06-15)

Feature: Add state-encryption flags and corresponding options to soarapps init.

3.24.0 (2026-06-11)

Feature: Add a guided initialization wizard to soarapps init.
Feature: Add non-interactive initialization.
Fix: Default initialization output to the app directory.
Feature: Generate a private pre-commit configuration for new apps.

3.23.0 (2026-06-11)

Feature: Support package-install authentication with PH_AUTH_TOKEN or PHANTOM_USERNAME and PHANTOM_PASSWORD.
Feature: Allow the Splunk SOAR instance to be set with SOAR_INSTANCE.

3.22.3 (2026-06-11)

Fix: Improve compatibility with tuple-shaped vault_add responses.

3.22.2 (2026-06-09)

Fix: on_poll automation scheduling so the final artifact in each container respects an explicit run_automation value.

3.22.1 (2026-06-05)

Fix: Decryption for sensitive asset fields that use aliases.

3.22.0 (2026-05-08)

Feature: Add optional additional_fields to Splunk Enterprise Security (ES) findings.
Docs: Document Finding models and their relationship to create_finding.

3.21.0 (2026-05-06)

Feature: Allow dec_key to be omitted when the platform does not provide one.

3.20.1 (2026-04-27)

Fix: Include LICENSE and NOTICE files in built app packages.

3.20.0 (2026-04-24)

Feature: Add soarapps manifests create-notice to generate a NOTICE file for app dependencies.

3.19.2 (2026-04-13)

Fix: Allow list-returning actions to produce separate action results.
Fix: Add flatten_results to retain the existing single-result behavior when needed.

3.19.1 (2026-04-06)

Fix: The __all__ syntax generated for new app packages.

3.19.0 (2026-04-06)

Feature: Include README.md and release notes in built app packages.
Feature: Add the optional --uv-index argument to soarapps init and soarapps convert.

3.18.1 (2026-03-30)

Fix: Limit ES poll batches to 25 findings.

3.18.0 (2026-03-23)

Feature: Clean up containers left behind after a failed ES poll batch.
Feature: Add the remove_when_soar_newer_than(7.0.0) option to ph_ipc.

3.17.1 (2026-03-17)

Fix: Improve source builds by including red-black-tree-mod and normalizing dependency names.

3.17.0 (2026-03-16)

Feature: Add parsing support for Microsoft Outlook MSG email files.
Feature: Organize email helpers under email_data while keeping compatible aliases for the previous rfc5322 names.

3.16.0 (2026-03-13)

Feature: Add reporter details and verification information to ES findings.
Fix: Remove the unused email dependency from the core SDK dependency set.

3.15.1 (2026-03-09)

Fix: Finding construction for non-Automation Broker environments.

3.15.0 (2026-02-28)

Feature: Add investigation_type handling to ES findings.

3.14.0 (2026-02-27)

Feature: Add filename and file-size data to ES findings.
Feature: Update ES finding creation to handle related containers and vault records.

3.13.0 (2026-02-24)

Feature: Add support for ES entity containers.

3.12.0 (2026-02-24)

Feature: Add bulk ES finding creation.
Feature: Add support for saving email attachments to a container’s vault.

3.11.2 (2026-02-24)

Fix: Preserve raw fields when initializing PermissiveActionOutput.

3.11.1 (2026-02-23)

Fix: Add serialization support for permissive action outputs.

3.11.0 (2026-02-20)

Feature: Allow apps to use permissive outputs that skip Pydantic validation.

3.10.1 (2026-02-18)

Fix: ES polling through Automation Broker and improve the polling workflow.

3.10.0 (2026-02-10)

Feature: Add attachment uploads to ES findings polling.
Feature: Improve ES findings polling triggers and use the Splunk ES proxy for communication.
Feature: Use optional syntax for polling parameters.

3.9.1 (2026-02-04)

Fix: Use optional type syntax for polling parameters.

3.9.0 (2026-02-03)

Fix: Allow optional type annotations in parameters and fields.
Feature: Use modern union syntax in soarapps convert output.
Fix: Omit redundant required=True values from generated code.

3.8.2 (2026-01-26)

Fix: The ES finding model and its usage.

3.8.1 (2026-01-22)

Fix: Make OutputField optional by default.

3.8.0 (2026-01-21)

Feature: Add the is_file option to AssetField for file uploads.

3.7.0 (2025-12-18)

Feature: Add OAuth authentication flows and standardize SDK authentication types.
Feature: Improve webhook redirect URL generation and state handling.
Feature: Add category metadata to asset fields.

3.6.1 (2025-12-15)

Fix: Manifest paths when building an app from source-built wheels.

3.6.0 (2025-12-12)

Feature: Add a client for submitting ES findings.
Feature: Update ES polling to use the new workflow.
Feature: Allow package builds to use a local SDK directory.
Feature: Add supports_es_polling to generated app manifests.

3.5.0 (2025-12-05)

Feature: Add email-processing helpers for RFC 5322 messages.
Fix: Improve URL extraction and forwarded-message parsing.

3.4.0 (2025-12-04)

Feature: Add poll metadata that distinguishes immediate polling from scheduled polling.

3.3.2 (2025-12-03)

Fix: Support all Python 3.14.x versions instead of only Python 3.14.0.

3.3.1 (2025-12-03)

Fix: Custom view handling.

3.3.0 (2025-12-02)

Feature: Add SDK command-line testing tools and a Model Context Protocol (MCP) testing tool.
Feature: Expand test options for actions, polling, webhooks, asset state, and Automation Broker integrations.

3.2.3 (2025-11-25)

Fix: Update MarkupSafe for Python 3.14-compatible wheels.

3.2.2 (2025-11-19)

Fix: Dependency resolution when a specific Python version is selected.
Fix: Use standard packaging specifiers and preserve indentation in generated multiline code.

3.2.1 (2025-11-06)

Fix: Selection of compatible abi3 wheels.

3.2.0 (2025-10-30)

Feature: Add the on_es_poll action type and example app support.
Feature: Add support for sending findings to Splunk Enterprise Security.

3.1.0 (2025-10-27)

Feature: Add an ES Finding model for platform and SDK use.

3.0.0 (2025-10-27)

Breaking changes:

Feature: Upgrade to Pydantic 2 and remove Pydantic 1 support. Apps that use Pydantic 1 APIs must migrate their validators, model configuration, and field access before upgrading. For example, replace @validator, class Config, and __fields__ with Pydantic 2 equivalents such as @field_validator, model_config, and model_fields.
Feature: Support only Python 3.13 and 3.14. Update the app’s Python requirement and runtime; Python 3.9 through 3.12 are no longer supported.
Feature: Require Splunk SOAR 7.0.0 or later. Upgrade the target Splunk SOAR environment before using SDK 3.x.

SDK 2

2.3.7 (2025-10-22)

Fix: Improve legacy phantom compatibility by isolating the import in the SDK shim.

2.3.6 (2025-10-21)

Fix: SDK paths when an app runs through Automation Broker.

2.3.5 (2025-10-18)

Fix: Allow optional action fields in input specifications.

2.3.4 (2025-10-10)

Fix: Generate a pre-commit configuration template and a release-notes directory during soarapps init.

2.3.3 (2025-10-10)

Fix: Clarify parameter descriptions for the Make Request action.

2.3.2 (2025-10-10)

Fix: Require release notes in app packages used for app updates and new-app flows.
Fix: Represent Python versions as strings in generated metadata.

2.3.1 (2025-10-07)

Fix: Improve Make Request handling and preserve empty action messages instead of substituting placeholder text.

2.3.0 (2025-10-02)

Feature: Add column names and ordering metadata to action parameters.

2.2.0 (2025-10-01)

Feature: Add the render_as option for action output rendering.

2.1.1 (2025-09-30)

Fix: List-valued action output handling.

2.1.0 (2025-09-26)

Feature: Allow actions to enable concurrency locks.

2.0.1 (2025-09-25)

Fix: Serialization and deserialization of nested list and optional types.

2.0.0 (2025-09-24)

Breaking changes:

Feature: Rename the generic action API to Make Request. Change app.generic_action() to app.make_request(), rename GenericActionParams and GenericActionOutput to MakeRequestParams and MakeRequestOutput, and update any manifest or action references from generic_action to make_request.
Feature: Remove the deprecated ActionOutput.generate_action_summary_message() method. Apps that call or override it must set action messages with SOARClient.set_message() instead.
Feature: Restore string-based view-handler references in generated manifests. Apps that register view handlers as callables must switch to import strings.

SDK 1

1.6.3 (2025-09-23)

Fix: Allow ActionOutput to be optional.

1.6.2 (2025-09-22)

Fix: An edge case when decrypting sensitive action parameters.

1.6.1 (2025-09-18)

Fix: A broken link in the SDK documentation.

1.6.0 (2025-09-18)

Feature: Add a method to retrieve the asset ID from the SOAR client.

1.5.3 (2025-09-18)

Fix: Document Splunk SOAR version compatibility and update documentation examples.

1.5.2 (2025-09-17)

Fix: Increase connection and read timeouts for soarapps install.

1.5.1 (2025-09-16)

Fix: Add the missing ActionResult.get_message() compatibility shim.
Fix: Remove the obsolete order argument from the Param documentation.

1.5.0 (2025-09-11)

Feature: Allow actions to be registered with import strings.
Fix: Preserve full view-handler import paths in generated manifests.

1.4.1 (2025-09-10)

Fix: Improve app conversion by preserving asset value types and using default Python versions.
Fix: Treat action parameters as optional by default during deserialization.
Fix: Normalize field names and create aliases for names that are not valid Python identifiers.

1.4.0 (2025-09-10)

Feature: Add a method to retrieve the container ID from the SOAR client.

1.3.4 (2025-09-09)

Fix: Improve documentation generation and style validation.

1.3.3 (2025-09-08)

Fix: Standardize Splunk SOAR terminology throughout the documentation.

1.3.2 (2025-09-07)

Fix: Write error-level logs to the error log.
Fix: Use soar as the canonical parameter name for the SOAR client in generated examples.
Fix: Improve the Getting Started and API Reference documentation.

1.3.1 (2025-09-05)

Fix: Add the CLI Reference and improve the documentation site’s presentation.

1.3.0 (2025-09-05)

Feature: Allow actions to set a result summary and message.
Feature: Warn when code uses the older action-message APIs.
Fix: Add successful-object totals to action output metadata.

1.2.3 (2025-09-02)

Fix: Correct documentation issues.

1.2.2 (2025-09-02)

Fix: Build the Splunk SDK from source when a compatible wheel is unavailable.

1.2.1 (2025-08-28)

Fix: Use field aliases when serializing action outputs.

1.2.0 (2025-08-28)

Feature: Allow actions to return iterable values containing multiple outputs.

1.1.0 (2025-08-22)

Feature: Add a timezone type for asset parameters.

1.0.2 (2025-08-21)

Fix: Correct package metadata and badges for the Python version and PyPI stability.

1.0.1 (2025-08-21)

Fix: Maintenance release with no user-facing SDK behavior changes.

1.0.0 (2025-08-21)

Feature: Initial stable release of the Splunk SOAR SDK.
Feature: Provide typed app and action definitions, manifest generation, CLI-based packaging and testing, compatibility shims, polling, webhooks, authentication, asset state, and documentation.

Changelog¶