Regarding the Splunk SOAR Automation Broker requirements, which of the following statements is not correct?

• A. The Splunk SOAR Automation Broker requires outbound/egress connectivity to the Splunk SOAR instance.
• B. The Splunk SOAR Automation Broker must connect to TCP port 443 on the Splunk SOAR instance.
• C. The Splunk SOAR Automation Broker requires both inbound and outbound connectivity to the Splunk SOAR instance.
• D. The Splunk SOAR Automation Broker requires inbound network connection from the Splunk SOAR instance.

Answer: (D)

The statement about the Splunk SOAR Automation Broker requiring an inbound network connection from the Splunk SOAR instance is not correct. The Automation Broker operates by facilitating communication primarily in an outbound direction. It is designed to connect from a client or an automation device to the Splunk SOAR instance, which implies that outbound connectivity (egress) is necessary for it to function properly and communicate with the Splunk SOAR resources and APIs.

In contrast, the other statements accurately reflect the operational needs of the Splunk SOAR Automation Broker. For example, it indeed requires outbound connectivity to the Splunk SOAR instance to send requests and receive responses related to automation tasks. It also specifies the need to connect through TCP port 443, which is the standard port for secure web traffic. Understanding the directionality of the connections is key, as the broker is not set up to receive inbound requests from the SOAR instance but rather initiates connections to it.