orcasecurity

Get your API token:Orca API Authentication Guide
MCP Integration Docs:Orca MCP Setup

# Triage an alert /orca-alert-triage orca-1234567 # Or use natural language triage alert orca-9012345 explain orca-2345678

investigate # Automated Orca-first investigation with manual steps only for gaps evidence # Detailed metadata, hashes, links, MITRE ATT&CK mappings remediate # Choose output format, then get remediation written to a file correlate # Related alerts and attack pattern analysis

═══════════════════════════════════════════════════════════════════ ANOMALY DETECTION: Unusual User Agent on EKS Node Role ═══════════════════════════════════════════════════════════════════ VERDICT: Likely Benign | CONFIDENCE: 90% | ACTION: Review & Close | TIMELINE: 48h WHAT HAPPENED: EKS node role used a new AWS SDK version (boto3/1.35.x → 1.36.x) during routine cluster operations. Single occurrence, no recurrence. WHY IT MATTERS: Risk Level: Low (Orca Score: 3.0) Same tool family, minor version bump, clean 30-day baseline. ═══════════════════════════════════════════════════════════════════

# Analyze impact of fixing an alert /orca-impact-analysis orca-3456789 # Or use natural language what's the impact of fixing orca-5678901? if I fix orca-0123456, what else closes?

═══════════════════════════════════════════════════════════════════ IMPACT ANALYSIS — orca-3456789 Root Account Without MFA Enabled "If I enable MFA on root, what closes — and what breaks?" ═══════════════════════════════════════════════════════════════════ ┌─────────────────────────────────────────────────────────────────┐ │ VERDICT: FIX NOW │ │ │ │ Security gain: HIGH — 2 critical alerts, 3 attack paths │ │ Breakage risk: LOW — no automation uses root console login │ │ Blast radius: 2 alerts, 3 attack paths, 8 frameworks │ └─────────────────────────────────────────────────────────────────┘ REMEDIATION IMPACT SUMMARY: Alerts directly closed: 2 (including this one) Attack paths broken: 3 Compliance frameworks: 8 frameworks improved COMPLIANCE SCORE CHANGE: Framework Current After Fix Change ───────────────────────────────────────────────────── PCI DSS v4.0.1 87% → 89% +2% NIST 800-53 91% → 93% +2% BREAKAGE RISK: [ok] EKS automation — uses access keys (MFA doesn't apply) [ok] Orca scanner — uses service role (not affected) [x] Unknown Kali agent — SHOULD break (that's the goal) BOTTOM LINE: High-leverage, low-risk fix. Apply immediately. ═══════════════════════════════════════════════════════════════════

"Who did this, how was it deployed, and what introduced the issue?"

Traces any Orca alert — misconfiguration, vulnerability, sensitive data, or anomaly — back through cloud audit logs, Orca CodeOrigins (Shift Left), and asset metadata to find who created the resource, what tool deployed it, what introduced the specific issue, and a full timeline from deployment to alert detection.

- Alert category classification — traces origin differently for misconfigurations (config IS the cause), vulnerabilities (package is the cause), sensitive data (image/script placed the secret), and anomalies (actor IS the finding)
- CodeOrigins / Shift Left integration — extracts exact IaC source code (repo, file, line numbers, git blame author/commit)
- Audit log tracing via Orca CDR (CloudTrail, Azure Activity Log, GCP Audit Log)
- Full visual timeline from IaC code commit → resource creation → issue introduction → alert detection, with exposure window calculation
- Split ownership — distinguishes resource owner (who deployed) from issue owner (who should fix)
- IaC drift detection — flags resources created by IaC but later modified via Console
- Category-aware remediation routing — tells you WHERE to apply the fix based on alert type AND deployment method

# Trace origin of any alert /orca-config-origin orca-3456789 # Or use natural language who created this misconfiguration? orca-3456789 trace back orca-5678901 where did this config come from? orca-3364845

═══════════════════════════════════════════════════════════════════ CONFIG ORIGIN — orca-4567890 Apache Log4j Remote Code Execution Vulnerability (CVE-2021-45046) ═══════════════════════════════════════════════════════════════════ ASSET: web-bastion-host (AwsEc2Instance) in 123456789012 ISSUE: log4j-core v2.3 installed — critically vulnerable to RCE ┌─────────────────────────────────────────────────────────────────┐ │ DEPLOYED BY: Terraform (module "ec2_unpatched") │ │ OWNER: Alex Chen (alex@example-corp.com) │ │ ROOT CAUSE: user_data script installs log4j-core-2.3.jar │ │ LAST CHANGE: 2025-12-01 (137 days ago) │ │ METHOD: Terraform → module "ec2/unpatched_ubuntu" │ └─────────────────────────────────────────────────────────────────┘ TIMELINE: 2024-06-23 ● Terraform code committed Alex Chen │ file: ec2.tf:71-80, commit: abc1234 2025-12-01 ● Instance created — user_data installs log4j 2.3 │ ⚠ VULNERABILITY INTRODUCED HERE 2025-12-01 ● Alert detected by Orca (73 min after creation) 2026-04-17 ● Today — 137 days exposed, still open REMEDIATION ROUTING: ⚠ The fix is NOT in ec2.tf — the Terraform deploys correctly. FIX IN: module.scripts.ec2_unpatched (the user_data script) → Update script to install log4j-core ≥ 2.16.0 ═══════════════════════════════════════════════════════════════════

"What happened while I was away, and what needs my attention?"

Daily security briefing for the last 24-72 hours. Scans your environment for new critical alerts, escalated findings, attack path changes, compliance drift, exposure changes, CDR activity anomalies, crown jewel risks, and aging unactioned alerts — then presents it all as a scannable dashboard with drill-down sections.

- Environment pulse — quick health assessment (stable, degrading, needs attention)
- New critical/high alerts with priority ranking
- Escalated alerts — severity increases and reopened findings
- Compliance drift — framework scores that dropped, with account breakdown
- CDR activity overview — event volumes, unusual actors, suspicious patterns
- Crown jewel risk — new alerts on your most critical assets
- Aging criticals — unactioned alerts with Jira ticket status
- Progressive disclosure — dashboard first (~20 lines), drill down by keyword
- Time range support — 24h (daily), 72h (Monday morning), week (PTO return)

# Daily briefing (last 24 hours) /orca-morning-briefing # Monday morning (last 72 hours) /orca-morning-briefing 72h # Weekly review /orca-morning-briefing week

Drill-down keywords(type after briefing):

alerts # Full list of new critical/high alerts escalated # Alerts that changed severity or reopened attack paths # New/worsened attack paths with stories compliance # Framework scores, trends, worst accounts exposure # Internet-facing assets with critical alerts crown jewels # New alerts on crown jewel assets aging # Unactioned critical alerts sorted by age activity # CDR event volumes, unusual actors new types # Alert types seen for the first time trends # Week-over-week comparison, top affected assets full # All sections expanded (for reports/handoffs)

═══════════════════════════════════════════════════════════════════ MORNING BRIEFING — 2026-04-17 Last 24 hours | Account: 123456789012 ═══════════════════════════════════════════════════════════════════ PULSE: ⚠ NEEDS ATTENTION — 3 new critical alerts ┌─────────────────────────────────────────────────────────────────┐ │ NEW ALERTS 12 total (3 critical, 4 high, 5 medium) │ │ ESCALATED 2 alerts changed severity or reopened │ │ ATTACK PATHS 1 new, 2 worsened │ │ COMPLIANCE PCI DSS dropped 2% │ │ EXPOSURE 1 asset newly internet-facing │ │ CROWN JEWELS 1 new alert on critical asset │ │ AGING CRITICALS 4 critical alerts open > 7 days │ │ CDR ACTIVITY Elevated — 3.2k events (normal: ~1k) │ └─────────────────────────────────────────────────────────────────┘ TOP PRIORITIES: [1] orca-4567890 — Log4j RCE on public bastion (137d open!) [2] orca-6789012 — S3 bucket publicly accessible (new today) [3] orca-7890123 — SendGrid API key exposed in container ═══════════════════════════════════════════════════════════════════

"Tell me everything about this asset in one place."

Full 360° security profile of any cloud asset — all open alerts (grouped by category), attack paths, compliance violations, permissions, network exposure, sensitive data, CDR activity summary, crown jewel status, and linked entities.

- Complete asset identity — name, type, account, region, IPs, OS, tags, creation date, IaC source
- Risk summary with Orca Score, crown jewel status, and exposure classification
- Alerts grouped by category — vulnerabilities, misconfigurations, malware, sensitive data, anomalies, IAM
- Attack path mapping — kill chains with the asset's role (entry point, pivot, target)
- Compliance framework violations per asset
- Effective permissions analysis (AWS IAM assets) with used vs unused breakdown
- CDR activity summary — 30-day event volumes, top actions, unique actors
- Linked entities — connected roles, instances, buckets, databases, load balancers
- Proactive remediation — suggests the highest-impact fix and offers to generate code in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

# Profile an asset by name, ID, or ARN /orca-asset-profile web-bastion-host /orca-asset-profile i-1234567890abcdef0 # Or use natural language tell me about web-bastion-host asset risk for vm-chain3-1

Drill-down keywords(type after profile):

alerts # All alerts by category attack paths # Kill chains with this asset compliance # Framework violations permissions # IAM analysis (used vs unused) exposure # Network exposure details activity # CDR events (last 30 days) linked # Connected assets code origin # IaC source mapping full # All sections expanded

═══════════════════════════════════════════════════════════════════ ASSET PROFILE — web-bastion-host AwsEc2Instance | 123456789012 | us-east-1 | running ═══════════════════════════════════════════════════════════════════ RISK: Orca Score 9.0 (Critical) | Crown Jewel: NO ┌─────────────────────────────────────────────────────────────────┐ │ ALERTS 12 total (3 critical, 4 high, 5 medium) │ │ ATTACK PATHS 4 active kill chains │ │ COMPLIANCE 6 frameworks, 18 failing controls │ │ EXPOSURE public_facing | ports: 22, 443 │ │ SENSITIVE API keys, credentials │ │ PERMISSIONS overprivileged (via instance profile) │ │ CDR ACTIVITY 847 events in 30d (elevated) │ │ LINKED 9 connected assets │ └─────────────────────────────────────────────────────────────────┘ TOP ALERTS: [1] orca-4567890 — Log4j RCE (score: 9.0, vulnerability) [2] orca-7890123 — SendGrid API key exposed (score: 8.5, sensitive data) [3] orca-3456789 — Root account without MFA (score: 8.0, misconfiguration) RECOMMENDED ACTION: The highest-impact fix is orca-4567890 (Log4j RCE on a public asset). I can generate remediation code right now. What format? terraform | cloudformation | cli | instructions ═══════════════════════════════════════════════════════════════════

"Where are we failing, what's the fastest path to improve?"

Deep compliance gap analysis for any framework — failing controls ranked by blast radius, quick wins (single-fix controls), account breakdown, score trends, and a phased remediation plan with projected score improvements.

- Framework overview with scores, trends, and worst/best identification
- Failing controls ranked by cross-framework impact and asset count
- Quick win detection — single-config fixes that improve multiple frameworks at once
- Account/business unit breakdown — who owns the worst gaps
- 30-day compliance trend analysis — improving, stable, or degrading
- Phased remediation plan — quick wins (days), systematic fixes (weeks), architectural changes (months)
- Projected score improvements per phase
- Proactive remediation — offers to generate fix code for any control in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

# All frameworks overview /orca-compliance-gap # Specific framework deep-dive /orca-compliance-gap PCI DSS /orca-compliance-gap CIS AWS # Or use natural language how's our PCI compliance? what's failing in SOC 2? quick wins for compliance

Drill-down keywords(type after analysis):

controls # All failing controls ranked by impact quick wins # Fastest path to score improvement accounts # Gap breakdown by account trends # 30-day score history remediation plan # Phased fix plan with projections full # All sections expanded

═══════════════════════════════════════════════════════════════════ COMPLIANCE GAP ANALYSIS — All Frameworks 2026-04-17 | All accounts ═══════════════════════════════════════════════════════════════════ POSTURE: Moderate — 3 frameworks below 85% target ┌─────────────────────────────────────────────────────────────────┐ │ FRAMEWORKS 8 enabled │ │ AVG SCORE 84% │ │ WORST HIPAA at 71% │ │ BEST CIS AWS at 94% │ │ TREND (30d) degrading — PCI dropped 2% │ │ QUICK WINS 6 controls fixable with single changes │ │ WORST ACCOUNT 123456789012 — 76% avg score │ └─────────────────────────────────────────────────────────────────┘ TOP FAILING CONTROLS (highest impact): [1] Enable MFA for root — failing on 3 accounts, affects 5 frameworks [2] Encrypt EBS volumes — failing on 12 assets, affects 4 frameworks [3] Restrict SSH access — failing on 8 assets, affects 4 frameworks RECOMMENDED ACTION: The fastest score improvement: enable MFA for root — affects 3 accounts across 5 frameworks. I can generate the fix. What format? terraform | cloudformation | cli | instructions ═══════════════════════════════════════════════════════════════════

"Where is our sensitive data, is it protected, and what's at risk?"

DSPM (Data Security Posture Management) view: discovers sensitive data across the environment — secrets, PII, credentials, API keys, financial data — identifies unprotected or exposed data stores, ranks data risks by exposure level, and generates a remediation plan.

- Full DSPM scan — secrets, PII, credentials, API keys, certificates, financial data
- Risk classification — critical (public + sensitive), high (internal + vulnerable), medium, low
- Data type grouping — secrets & credentials, PII, financial data, health data, private keys
- Public data store detection — S3 buckets, databases, file shares with public access
- Unencrypted data store identification with encryption recommendations
- Compliance context — PCI DSS, HIPAA, GDPR, SOC 2 data protection control status
- Account breakdown of data risk distribution
- Phased remediation plan — stop the bleeding, encrypt everything, access controls, governance
- Proactive remediation — generates rotation scripts, bucket policies, encryption configs in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

# Full DSPM report /orca-data-exposure # Filter by type or account /orca-data-exposure secrets /orca-data-exposure account 123456789012 # Or use natural language where's our sensitive data? find exposed API keys what PII is at risk?

Drill-down keywords(type after report):

secrets # Exposed secrets & credentials pii # PII exposure details public data # Publicly accessible data stores unencrypted # Data stores without encryption compliance # Data protection compliance status accounts # Data risk by account remediation plan # Phased data protection plan full # All sections expanded

═══════════════════════════════════════════════════════════════════ DATA EXPOSURE REPORT — All Accounts 2026-04-17 | Full environment ═══════════════════════════════════════════════════════════════════ DATA POSTURE: At Risk — 3 critical data exposures on public assets ┌─────────────────────────────────────────────────────────────────┐ │ TOTAL FINDINGS 24 data exposure alerts │ │ CRITICAL 3 — immediate breach risk │ │ HIGH 8 — significant exposure │ │ SECRETS 11 exposed credentials/API keys/tokens │ │ PII 5 assets with personally identifiable data │ │ PUBLIC DATA 2 publicly accessible data stores │ │ UNENCRYPTED 6 data stores without encryption │ │ CROWN JEWELS 2 data findings on critical assets │ │ COMPLIANCE PCI DSS, HIPAA gaps on data controls │ └─────────────────────────────────────────────────────────────────┘ TOP DATA RISKS: [1] orca-7890123 — SendGrid API key in container image (score: 8.5) web-bastion-host | credential | public-facing [2] orca-8901234 — AWS access key in environment variable (score: 8.0) ci-build-server | infrastructure secret | internal [3] orca-6789012 — S3 bucket publicly accessible (score: 7.5) s3-data-lake-prod | PII + financial data | public RECOMMENDED ACTION: Priority #1: Rotate the SendGrid API key on web-bastion-host and move to Secrets Manager. I can generate the rotation script. What format? terraform | cloudformation | cli | instructions ═══════════════════════════════════════════════════════════════════

"What can an attacker see from outside?"

External attack surface mapping: discovers all internet-facing assets, ranks them by exploitability from an attacker's perspective, groups by attack vector (exposed services, public storage, vulnerable web apps, open management ports), and maps outside-in kill chains to crown jewels.

- Full external attack surface inventory — internet-facing assets ranked by risk
- Attacker-perspective ranking — "how would an attacker prioritize these targets?"
- Attack vector grouping — easy wins, web apps, management ports, public data, lateral movement entry points
- Outside-in attack path mapping — from exposed asset through pivots to crown jewels
- Exposed management interfaces (SSH, RDP, admin panels) with authentication status
- Public data store detection (S3, databases, file shares)
- Account-level exposure breakdown
- Proactive remediation — generates security group rules, bucket policies, WAF configs in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

# Full attack surface map /orca-exposure-map # Filter by account or vector /orca-exposure-map account 123456789012 /orca-exposure-map web services # Or use natural language what's exposed to the internet? show me our attack surface what can an attacker see?

easy wins # Immediately exploitable — fix first web apps # Exposed web applications management # SSH, RDP, admin panels data # Public data stores attack paths # Outside-in kill chains accounts # Exposure by account all assets # Complete exposed asset list full # All sections expanded

═══════════════════════════════════════════════════════════════════ EXPOSURE MAP — External Attack Surface 2026-04-17 | All accounts ═══════════════════════════════════════════════════════════════════ SURFACE: Moderate — 4 immediately exploitable targets ┌─────────────────────────────────────────────────────────────────┐ │ EXPOSED ASSETS 18 internet-facing │ │ CRITICAL RISK 4 immediately exploitable │ │ HIGH RISK 7 exploitable with effort │ │ PUBLIC STORAGE 2 buckets/blobs publicly accessible │ │ EXPOSED MGMT 3 SSH/RDP/admin panels │ │ EXPOSED DATABASES 1 database reachable from internet │ │ CROWN JEWELS 2 exposed critical assets │ │ ATTACK PATHS 5 outside-in kill chains │ └─────────────────────────────────────────────────────────────────┘ TOP TARGETS (attacker's priority list): [1] web-bastion-host — Log4j RCE + public SSH (score: 9.0) AwsEc2Instance | 54.210.xx.xx | ports: 22, 443, 8080 [2] s3-data-lake-prod — public S3 with PII (score: 7.5) AwsS3Bucket | public-read | contains financial data [3] ci-build-server — exposed admin panel (score: 7.0) AwsEc2Instance | 52.90.xx.xx | ports: 8080, 50000 RECOMMENDED ACTION: Priority #1: Lock down web-bastion-host — patch Log4j and restrict SSH to VPN CIDR. I can generate the fix. What format? terraform | cloudformation | cli | instructions ═══════════════════════════════════════════════════════════════════

"Is this identity overprivileged, and what's the blast radius?"

IAM identity analysis: compares effective permissions vs actual CloudTrail usage, identifies overprivileged access, maps lateral movement potential (role assumptions, cross-account reach), and generates least-privilege policy recommendations.

# Review an identity by name or ARN /orca-identity-review admin-role /orca-identity-review arn:aws:iam::123456789012:role/ec2-bastion-role # Or use natural language is terraform-deploy overprivileged? review the permissions on admin-role what can this role access?

Drill-down keywords(type after review):

permissions # Full permission list (used, unused, dangerous) usage # CDR activity details (actions, IPs, agents) lateral # Lateral movement analysis attack paths # Kill chains through this identity alerts # Open alerts on this identity activity # 30-day CDR event summary recommend # Least-privilege policy recommendation full # All sections expanded