Orca Event Collector

Details

ID	`Orca Event Collector`
Provider	Orca Security
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.11753038`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Orca Security event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 0.1.0 of Orca Event Collector

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Orca Event Collector in Cortex

Parameter	Description	Required
API Token	The API Key to use for connection	True
Server URL (for example: https://app.eu.orcasecurity.io/api)	For more information about the different regions and ips in the link	True
First fetch time	First fetch query `<number> <time unit>`, e.g., `7 days`. Default `3 days`)	False
The maximum number of events per fetch	The number of events to fetch. Maximum value is 1000	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

orca-security-get-events

Manual command to fetch events from Orca Security.

Base Command

orca-security-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

server_url — Server URL (for example: https://app.eu.orcasecurity.io) (required)
credentials — (required)
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — The maximum number of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch Events
eventFetchInterval — Events Fetch Interval

Commands (1)

orca-security-get-events
Manual command to fetch events from Orca Security.

Source

OrcaEventCollector.py OrcaEventCollector_test.py OrcaEventCollector.yml OrcaEventCollector_description.md

Download History Raw

## Orca Security
This section explains how to fully configure the instance of Orca Security in Cortex XSIAM.

## Steps to follow to configure orca Security
1. In Orca, navigate to **Settings > Users & Permissions > API** and click **Create API Token**.
2. Enter or select the following criteria:
   - Enter the token name
   - Enter a description
   - Mark or clear Never Expire: Never expire is marked by default. The expiration date can be configured by clearing the checkbox.
   - Mark or clear Public: You can define public tokens that are not linked to a specific user. The token is scoped according to the user that created them but can still be used if the user is removed from the organization.
     Select a role. 
   - Select the accounts that you want users to have access to 
3. Click **Create Token**.
4. Copy the token and click Continue
5. In the Cortex XSIAM configuration window:
    - Enter the server url. For more information about the different regions and ips [click](https://docs.orcasecurity.io/docs/regions-and-ips)
    - Paste the Api Token copied from Orca.
    - Enter the First fetch time (default is 3 days)
    - Choose max fetch (up to 1000)
    - Check Trust any certificate (not secure) checkbox
    - Use system proxy settings checkbox
    - Check "Fetches events" radio button
    - Click "Test" button to make sure Api Key is valid and then click the "Done" button

For more information about managing api tokens in Orca security [click](https://docs.orcasecurity.io/v1/docs/managing-api-tokens)