Skip to main content

Orca Security

Visualize Orca Security assets, findings, roles, users, and user groups, map Orca users to employees, and monitor changes through queries and alerts.

Installation​

To set up this integration, you first create an API token in Orca Security and then provide it, along with your account email and API base URL, when you configure the integration instance in JupiterOne.

Prerequisites​

  • An Orca Security account, with an administrator available to create the API token (token creation requires an admin user).
  • An API token assigned the read-only Viewer role. This is the minimum and sufficient role for the integration: it provides read-only access to all Orca resources the integration ingests, including alerts, assets, users, roles, and vulnerabilities. The Editor and Administrator roles are not required.
  • The token must cover your entire organization. A token limited to a partial account or business-unit scope can result in missing data or authorization errors.

Create the API token in Orca​

  1. Log into Orca Security and navigate to Settings > Users & Permissions > API.
  2. Select Add API Token.
  3. Enter a Name and, optionally, a Description.
  4. For Role, select Viewer.
  5. For Scope, select All Cloud Accounts to ingest data from your entire organization.
  6. Confirm and add the token, then copy the token value that appears.
caution

The token value is displayed only once. Copy it before closing the dialog; you cannot retrieve it again afterward.

note

Orca's full API reference is available inside your tenant under Settings > API. For step-by-step guidance on creating an API token, see the Orca credential guide.

Configuration in JupiterOne​

To install the Orca integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Orca. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • A name for the integration instance, used to identify the Orca account in JupiterOne.
  • A Description to help identify the integration instance, if desired.
  • A Polling Interval sufficient for your monitoring needs. You can leave this as DISABLED and run the integration manually.
  • Your Orca Security Account Email, the email address used within Orca to generate the API token.
  • Your Orca Security API Token, the token value you copied when creating the token above.
  • Your Orca API Base URL, the region-specific base URL of your Orca API (for example, https://api.orcasecurity.io).

You can also set the following optional field:

  • Include Closed Alerts: When enabled, closed alerts are included when ingesting Orca Security alerts. This is disabled by default.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.