category: Analytics & SIEM
provider: Orca Security
commonfields:
  id: Orca Event Collector
  version: -1
sectionorder:
- Connect
- Collect
description: Orca Security event collector integration for Cortex XSIAM.
display: Orca Event Collector
name: Orca Event Collector
configuration:
- display: 'Server URL (for example: https://app.eu.orcasecurity.io)'
  name: server_url
  required: true
  type: 0
  additionalinfo: For more information about the different regions and ips in the link- https://docs.orcasecurity.io/docs/regions-and-ips
  section: Connect
- displaypassword: API Token
  additionalinfo: The API Key to use for connection
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- name: first_fetch
  defaultvalue: 1 minute
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days)
  type: 0
  section: Collect
  required: false
- defaultvalue: 1000
  display: The maximum number of events per fetch
  name: max_fetch
  type: 0
  section: Collect
  additionalinfo: The number of events to fetch. Maximum value is 1000
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- name: isFetchEvents
  display: Fetch Events
  defaultvalue: 'true'
  type: 8
  section: Collect
  required: false
  additionalinfo: Whether to fetch events.
- name: eventFetchInterval
  display: Events Fetch Interval
  type: 19
  section: Collect
  required: false
  advanced: true
  additionalinfo: The interval at which to fetch events.
script:
  commands:
  - description: Manual command to fetch events from Orca Security.
    name: orca-security-get-events
    arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      predefined:
      - 'True'
      - 'False'
      required: true
    - name: start_time
      description: The start of the time range to fetch events from (inclusive lower bound on LastUpdated). Accepts ISO 8601 or relative formats such as "3 days".
      required: false
    - name: end_time
      description: The end of the time range to fetch events from (exclusive upper bound on LastUpdated). Defaults to now.
      required: false
    - name: limit
      description: The maximum number of events to return.
      defaultValue: '1000'
      required: false
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.11753038
fromversion: '6.8.0'
supportlevelheader: xsoar
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam