Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent

Splunk SOAR (On-premises) 8.7.0 reached general availability on 2026-09-02 and drops support for Python 3.9. The Cloud release notes add a Connector Builder Agent in the same version, after an Automation Builder agent in 8.6.0. Splunk says the agents run in Cloud only and need Splunk Enterprise Security 8.6 or later. The agents build automation. They do not decide cases.

We do not date 8.6.0, because Splunk pages disagree: the cloud notes show July 21, 2026 and the on-prem notes August 4, 2026, in search results we did not open. Playbooks created in 6.4.0 and later are also not backward compatible with earlier versions.

Source: help.splunk.com, read 2026-11-03.

What it changes for a buyer

Any custom function written for Python 3.9 needs conversion before you upgrade. The agent features are Cloud only, so an on-prem team does not get them by upgrading.

Other dispatches

• Mate Labs publishes the Blue City benchmark, without Mate in it, 3 November 2026
• XSOAR 8.11 reaches end-of-life on 2026-11-13, 3 November 2026
• Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed, 3 November 2026
• ThreatConnect's domain now redirects to Dataminr, 3 November 2026
• Google updates its SecOps playbooks screen documentation, 28 October 2026
• Torq says IDC named it a Leader in its AI SOC MarketScape, 20 October 2026
• Mate publishes CPR, its gate for autonomous actions, 18 October 2026
• Google SecOps curated rules move to the GTI_IOC feed, 12 October 2026
• Mate Gamebooks reach general availability, 26 August 2026
• Microsoft updates its Splunk SOAR to Sentinel migration guide, 12 August 2026
• ServiceNow press report puts a Tier 2 SOC AI Specialist in December, 5 August 2026

More notes in Dispatches. To see the platforms side by side, start from the card.