Orca Event Collector

Details

ID	`Orca Event Collector`
Provider	Orca Security
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.11753038`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Orca Security event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 0.1.0 of Orca Event Collector

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Orca Event Collector in Cortex

Parameter	Description	Required
API Token	The API Key to use for connection	True
Server URL (for example: https://app.eu.orcasecurity.io/api)	For more information about the different regions and ips in the link	True
First fetch time	First fetch query `<number> <time unit>`, e.g., `7 days`. Default `3 days`)	False
The maximum number of events per fetch	The number of events to fetch. Maximum value is 1000	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

orca-security-get-events

Manual command to fetch events from Orca Security.

Base Command

orca-security-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

server_url — Server URL (for example: https://app.eu.orcasecurity.io) (required)
credentials — (required)
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — The maximum number of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch Events
eventFetchInterval — Events Fetch Interval

Commands (1)

orca-security-get-events
Manual command to fetch events from Orca Security.

Source

OrcaEventCollector.py OrcaEventCollector_test.py OrcaEventCollector.yml OrcaEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Orca Security
commonfields:
  id: Orca Event Collector
  version: -1
sectionorder:
- Connect
- Collect
description: Orca Security event collector integration for Cortex XSIAM.
display: Orca Event Collector
name: Orca Event Collector
configuration:
- display: 'Server URL (for example: https://app.eu.orcasecurity.io)'
  name: server_url
  required: true
  type: 0
  additionalinfo: For more information about the different regions and ips in the link- https://docs.orcasecurity.io/docs/regions-and-ips
  section: Connect
- displaypassword: API Token
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- name: first_fetch
  defaultvalue: 1 minute
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days)
  type: 0
  section: Collect
  required: false
- defaultvalue: 1000
  display: The maximum number of events per fetch
  name: max_fetch
  type: 0
  section: Collect
  additionalinfo: The number of events to fetch. Maximum value is 1000
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- name: isFetchEvents
  display: Fetch Events
  defaultvalue: 'true'
  type: 8
  section: Collect
  required: false
  additionalinfo: Whether to fetch events.
- name: eventFetchInterval
  display: Events Fetch Interval
  type: 19
  section: Collect
  required: false
  advanced: true
  additionalinfo: The interval at which to fetch events.
script:
  commands:
  - description: Manual command to fetch events from Orca Security.
    name: orca-security-get-events
    arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      predefined:
      - 'True'
      - 'False'
      required: true
    - name: start_time
      description: The start of the time range to fetch events from (inclusive lower bound on LastUpdated). Accepts ISO 8601 or relative formats such as "3 days".
      required: false
    - name: end_time
      description: The end of the time range to fetch events from (exclusive upper bound on LastUpdated). Defaults to now.
      required: false
    - name: limit
      description: The maximum number of events to return.
      defaultValue: '1000'
      required: false
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.11753038
fromversion: '6.8.0'
supportlevelheader: xsoar
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam