Orca Security — Integration Setup

Prerequisites

• Orca Security account with cloud accounts (AWS/Azure/GCP) already onboarded
• Orca admin access to generate API tokens
• CMDash Essentials tier or above

Step 1: Generate an API Token

1. Log in to the Orca Security portal.
2. Go to Settings → API Tokens (sometimes labeled API Keys).
3. Click Create Token, name it CMDash Integration, and select a read-only role if your Orca edition supports scoped tokens.
4. Copy the generated token — it is shown only once.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Orca Security and click Connect.
3. Enter:
   • API Token (stored as this connection's access token, sent as Authorization: Token <token>)
   • Region (e.g., us; defaults to us if left blank — use the region matching where your Orca instance is hosted)
4. Click Save & Test Connection.

What Syncs

CMDash pulls every open Orca alert via the paginated /api/alerts endpoint (next_page_token) and splits the result set client-side: anything Orca tags as a vulnerability-category alert becomes a CMDash vulnerability record (with CVE ID and CVSS score if present); everything else — cloud misconfigurations, malware detections, identity/access findings, lateral-movement risk, etc. — becomes a CMDash incident. The sync stops after 2,000 alerts.

Troubleshooting

• 401 Unauthorized: Token expired or revoked; regenerate in the Orca portal.
• 403 Forbidden: The token's role doesn't have read access to alerts.
• Wrong region / empty results: Confirm the Region field matches your Orca deployment (https://api.{region}.orcasecurity.io).
• Everything lands as an "incident" and nothing as a "vulnerability": Orca's type_string/category fields must match vulnerability / Vulnerabilities exactly for CMDash to classify an alert as a vulnerability — some Orca alert categories that conceptually look like vulnerabilities (e.g., certain CVE-based cloud workload findings) may still be tagged with a different category string and land in the incident bucket instead.

Rate Limits & Sync Behavior

Credential Rotation

Orca API tokens do not have a fixed expiry by default. CMDash recommends rotating quarterly.

To rotate:

1. In the Orca portal: Settings → API Tokens → Create Token.
2. In CMDash: Settings → Integrations → Orca Security → Edit.
3. Enter the new API Token and Save.
4. Revoke the old token in Orca once confirmed working.

Note: Orca tokens expose no expiry metadata to CMDash, so the 30-day expiry warning banner is not shown for this integration.

Multiple Instances / Multi-Site

If your Orca deployment spans multiple regions, or you want to segment by business unit with separate tokens, add a connection per scope.

To add another connection:

1. Generate an additional API token, following Step 1.
2. In CMDash: Settings → Integrations → Add Integration → Orca Security.
3. Enter the token and region for the additional scope.
4. Give the connection a descriptive name (e.g., Orca - AWS Prod, Orca - Azure).
5. Click Save & Test Connection.

Compliance Framework Coverage

The Orca Security integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.