Orca

Details

ID	`Orca`
Provider	Orca Security
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Agentless, Workload-Deep, Context-Aware Security and Compliance for AWS, Azure, and GCP.
This integration was integrated and tested with Orca

Configure Orca in Cortex

Parameter	Description	Required
apitoken	API Token	True
api_host	API Host without schema. Default: `api.orcasecurity.io`	False
first_fetch	First fetch timestamp (`<number>` `<time unit>`, e.g., 12 hours, 7 days)	False
incidentType	Incident type	False
isFetch	Fetch incidents	False
max_fetch	Max fetch	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

orca-get-alerts

Get the alerts on cloud assets

Base Command

orca-get-alerts

Input

Argument Name	Description	Required
alert_type	Type of alert to get.	Optional
asset_unique_id	Get alerts of asset_unique_id.	Optional

Context Output

Path	Type	Description
Orca.Manager.Alerts	String	All alerts

Command Example


### orca-get-asset

***
Get Description of An asset (Deprecated)

#### Base Command

`orca-get-asset`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| asset_unique_id | Asset unique id. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Orca.Manager.Asset | String | Asset description |

#### Command Example

Base Command

orca-set-alert-severity

Input

Argument Name	Description	Required
alert_id	Id of the alert.	Required
score	New score value. From 0 to 10.	Required

Context Output

Path	Type	Description
Orca.Alert	String	Alert description

Command Example

!orca-set-alert-severity alert_id=orca1 score=5

orca-get-alert-event-log

Input

Argument Name	Description	Required
alert_id	Id of the alert.	Required
limit	Limit of the event logs	Optional
start_at_index	Start at index	Optional
type	Type of the event logs	Optional

Context Output

Path	Type	Description
Orca.Manager.EventLog	String	Event log

Command Example

!orca-get-alert-event-log alert_id=orca1 limit=10

orca-set-alert-status

Input

Argument Name	Description	Required
alert_id	Id of the alert.	Required
status	New alert status	Required

Context Output

Path	Type	Description
Orca.SetAlertStatus	String	Operation result

Command Example

!orca-set-alert-status alert_id=orca1 status=open

orca-verify-alert

Input

Argument Name	Description	Required
alert_id	Id of the alert.	Required

Context Output

Path	Type	Description
Orca.VerifyAlert	String	Operation result

Command Example

!orca-verify-alert alert_id=orca1

orca-download-malicious-file

Input

Argument Name	Description	Required
alert_id	Id of the alert.	Required

Context Output

Path	Type	Description
Orca.File	unknown	Malicious File

Command Example

!orca-download-malicious-file alert_id=orca1

Configuration parameters

api_token — (required)
api_host — API Host
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents
max_fetch — Max fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
fetch_informational — Also Fetch informational alerts (deprecated)
pull_existing_alerts — Pull Existing Alerts

Commands (7)

orca-download-malicious-file
Downloads a capture file from CS Enterprise.
orca-get-alert-event-log
Get alert event log.
orca-get-alerts
Get the alerts on cloud assets.
orca-get-asset
Get Description of An asset. Deprecated, disabled.
orca-set-alert-severity
Change severity for the alert.
orca-set-alert-status
Get alert event log.
orca-verify-alert
Trigger verify alert.

Source

Orca.py Orca_test.py Orca.yml Orca_description.md command_examples.txt

Download History Raw

category: Utilities
provider: Orca Security
sectionorder:
- Connect
- Collect
commonfields:
  id: Orca
  version: -1
configuration:
- displaypassword: API Token
  hiddenusername: true
  name: api_token
  required: true
  type: 9
  section: Connect
- display: API Host
  name: api_host
  required: false
  type: 0
  defaultvalue: api.orcasecurity.io
  section: Connect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  required: false
  type: 0
  section: Collect
- display: Incident type
  name: incidentType
  required: false
  type: 13
  section: Connect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  required: false
  type: 8
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '200'
  display: Max fetch
  name: max_fetch
  required: false
  type: 0
  additionalinfo: The number of objects to process. Maximum value is 500
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Also Fetch informational alerts (deprecated)
  name: fetch_informational
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: If this checked, all existing alerts will be fetched
  display: Pull Existing Alerts
  name: pull_existing_alerts
  required: false
  type: 8
  section: Collect
  advanced: true
description: Agentless, Workload-Deep, Context-Aware Security and Compliance for AWS, Azure, and GCP.
display: Orca
name: Orca
script:
  commands:
  - arguments:
    - default: false
      description: Type of alert to get.
      isArray: false
      name: alert_type
      predefined:
      - ''
      required: false
      secret: false
    - default: false
      description: Get alerts of a specific asset.
      isArray: false
      name: asset_unique_id
      required: false
      secret: false
    deprecated: false
    description: Get the alerts on cloud assets.
    execution: false
    name: orca-get-alerts
    outputs:
    - contextPath: Orca.Manager.Alerts
      description: All alerts.
      type: String
  - name: orca-get-asset
    arguments:
    - description: Asset unique id.
      name: asset_unique_id
      required: true
    description: Get Description of An asset. Deprecated, disabled.
    outputs:
    - contextPath: Orca.Manager.Asset
      description: Asset description.
      type: String
  - name: orca-set-alert-severity
    description: Change severity for the alert.
    arguments:
    - name: alert_id
      description: Alert id.
      required: true
    - name: score
      description: The Orca Score to set. Valid range 1.0 to 10.
      required: true
    outputs:
    - contextPath: Orca.Alert
      description: Changed alert.
      type: string
  - name: orca-get-alert-event-log
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    - name: limit
      description: Limit of the event logs.
      defaultValue: "20"
    - name: start_at_index
      description: Start at index.
      defaultValue: "0"
    - name: type
      auto: PREDEFINED
      predefined:
      - comment
      - set_status
      - score_override
      - dismiss
      - snooze
      - jira_link
      - jira_add_vulnerabilities
      - jira_change_log_event
      - reset_fim_baseline
      - verification_scan_status
      - automation_rule_action
      - azure_devops_work_item_link
      - azure_devops_work_item_unlink
      - alert_timeline_api_event
      - service_now_incident_link
      - service_now_incident_unlink
      - service_now_si_incident_link
      - service_now_si_incident_unlink
      description: Type of the event logs.
    outputs:
    - contextPath: Orca.Manager.EventLog
      description: Alert Event Log.
    description: Get alert event log.
  - name: orca-set-alert-status
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    - name: status
      auto: PREDEFINED
      predefined:
      - in_progress
      - dismiss
      - dismissed
      - open
      - close
      - closed
      description: Alert status.
    outputs:
    - contextPath: Orca.Alert
      description: Changed alert.
      type: string
    description: Get alert event log.
  - name: orca-verify-alert
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    outputs:
    - contextPath: Orca.Alert
      description: Set Verify Alert result.
    description: Trigger verify alert.
  - name: orca-download-malicious-file
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    outputs:
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
    description: Downloads a capture file from CS Enterprise.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.0.0