setup

Orca Security

Purpose

Ingests Orca Security alerts and per-target CVE findings into SubImage without duplicating cloud inventory already discovered from AWS, Azure, or GCP.

tip

Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.

Required Fields

Field Secret? Description
orca_api_endpoint No Regional Orca Security HTTPS API origin, without /api or another route
orca_api_token Yes Orca Security API token with organization-wide read access to required data

Setup Steps

  1. In Orca Security, create a read-only API token that applies to the entire organization.
  2. Grant the token access to read the organization identity and query Alert and VulnerabilityV2 data, including related Inventory context.
  3. Store the token as a plaintext secret in AWS Secrets Manager and copy the Secret ARN (or paste the value into SubImage's managed vault).
  4. Identify the regional Orca Security HTTPS API origin for the tenant, such as https://api.orcasecurity.io. Do not include /api or another route.
  5. In SubImage, fill in orca_api_endpoint and orca_api_token, then save the module.

Notes

  • The sync is read-only.
  • The token must cover the complete organization because stale-data cleanup requires a complete snapshot.
  • VulnerabilityV2 results must include Inventory.AssetUniqueId.

Troubleshooting

  • For HTTP 401 responses, create a valid token and update the module credential.
  • For HTTP 403 responses or missing findings, verify the token has organization-wide read access.
  • If Inventory.AssetUniqueId is missing, inspect the response in Orca's authenticated Serving Layer Request Builder.
On this page
PurposeRequired FieldsSetup StepsNotesTroubleshooting