Orca Security

Get code origin traceability data linking an alert to its source code. Use this tool FIRST whenever the user asks about the code, source file, or origin that caused an alert. Many cloud misconfigurations originate from IaC (Terraform, CloudFormation, etc.) - always check before assuming an alert has no code origin. Retrieves the complete code-to-cloud lineage, including source repositories, modules, and deployment pipelines that produced this asset. This enables shift-left security by connecting runtime findings back to source code. Use this tool to: - Trace assets back to their source code repositories - Identify responsible development teams and code owners - Map runtime security issues to specific code modules - Understand deployment provenance and build lineage Example usage: - "Where did this related EC2 instance come from in the code?" - "Show me the code origin for alert orca-1234" - "Show me the specific code that triggered this alert", - "Who's the owner of this alert?" Returns: ServingLayerResponse: data with code origin details including repositories, modules, commits, and deployment metadata.

get_alert_code_origin

Get timeline events for a given alert id (data contains the timeline events). This data consists of alert operational events history within orca platform (like alert open , close, snooze, etc), state changes and tickting system updates and links including the user info that performed the actions. This tool is useful to get the history of the alert and the actions performed on it. This tool does not serve the alert data, for that use the get_alert tool. Example questions on this data: 1. "Show me the history of this alert" 2. "When did this alert status change?" 3. "Who acknowledged this alert?" 4. "Has this alert been triggered before?" 5. "The ticket was opened for this alert?" Returns: AlertTimelineResponse: JSON data with the alert timeline events.

get_alert_timeline

Get alerts with the same alert type as the given alert id (data contains list of similar alerts). Returns: ServingLayerResponse: data with matching alerts by type.

get_alerts_with_similar_alert_type

Get alerts with similar malware on the same asset (data contains list of similar alerts). Returns: ServingLayerResponse: data with a list of related alerts.

get_alerts_with_similar_malware

Get asset alerts count grouped by risk level (severity). Retrieves all open and in-progress alerts count for an asset, grouped by their RiskLevel (Critical, High, Medium, Low, Informational). Use this tool to: - Analyze alert distribution by severity - Get a risk-based overview of asset security issues Example usage: - "Show alerts grouped by severity for asset c46cb523-30c2-1584-1aa0-5284e5b68222" - "What are the risks on this?" - "Show risk summary for this asset" Returns: ServingLayerResponse: data with alerts grouped by RiskLevel, showing counts and details for each severity group.

get_asset_alerts_count_grouped_by_risk_level

Get the asset associated with a given alert. Retrieves full asset details for the resource that triggered this alert, including cloud account information. Use this tool when you need to: - Get detailed information about the asset that caused an alert - Find the cloud account where the asset is located - Understand the asset type and properties related to an alert Example questions: - "What asset is this alert for?" - "Show me the asset details for alert orca-1234" - "Which resource triggered this alert?" - "what assets does this VM have access to?" - "What container image needs to be fixed for this alert?" Note on identical-asset groups: Orca groups identical assets (e.g. the same container image provisioned hundreds of times) under a single asset group which has 1 alert for the entire group. This tool returns only one representative asset in ``data`` but the ``total_items`` field reflects the full size of the identical-asset group. If ``total_items > 1``, the returned asset is one specimen and there are ``total_items - 1`` more identical siblings sharing the same alert. Returns: ServingLayerResponse: ``data`` contains a single representative asset (with nested ``RepresentativeAsset`` for grouped containers); ``total_items`` is the count of identical assets in the group.

get_asset_by_alert_id

Get detailed base asset information for a given asset id (UUID or asset_unique_id) and model type. Retrieves comprehensive asset data including metadata, tags, relationships, security posture, configuration, vulnerabilities, asset ids (eg: ARN, asset_unique_id, group_unique_id, etc). Requires asset ID field, model type is optional (e.g., AwsEc2Instance, AwsS3Bucket, Inventory) to retrieve the correct asset record. Usually used to get all the base data related to the asset - which is used as data arguments for other tool calls Use this tool to: - Analyze asset configuration and properties - Check asset security posture and risk level - Review asset relationships and dependencies - Examine metadata, tags, and environmental context Example usage: - "Get details for EC2 instance c46cb523-30c2-1584-1aa0-5284e5b68222" (model_type: AwsEc2Instance) - "Show me information about S3 bucket abc12345-..." (model_type: AwsS3Bucket) - "What are the properties of this IAM role?" (model_type: AwsIamRole) Returns: EnrichedServingLayerResponse: data with the complete asset record including configuration, metadata, relationships, security findings, and ui_url for each entity.

get_asset_by_id

Search assets by display name substring (Name containing), then return enriched records. Prefer get_asset_by_id when you already have a uuid or asset_unique_id. Returns: EnrichedServingLayerResponse: zero or more assets matching the name substring, each with the same shape as get_asset_by_id (up to name_match_limit rows).

get_asset_by_name

Check if a specific asset is designated as a crown jewel and how it was classified. Retrieves crown jewel status for an asset identified by its group_unique_id. Crown jewels are inventory assets that represent high-value targets in the event of a breach. The classification source is returned as either 'manual' (designated by a user) or 'auto_detected'. For manually marked assets, additional details are included: who set it, when, the severity level, and an optional description. Use this tool to: - Check if a specific asset is a crown jewel - Determine whether the crown jewel status was set manually or auto-detected by the system - Get the detected crown jewel score and the reason behind the classification - For manually marked assets: see who designated it, when, and with what severity/description Example usage: - "Is asset vm_506464807365_i-0fb4afd545ba01a07 a crown jewel?" - "Check crown jewel status for this asset" - "Was this resource manually marked as a crown jewel or auto-detected?" - "Who marked this asset as a crown jewel and when?" Returns: AssetCrownJewelResponse: The crown jewel information for the asset.

get_asset_crown_jewel_info

Get a summary of related alerts for an asset. Returns only the top 50 alerts (by Orca score). Use total_items in the response for the full count Retrieves only the key fields of alerts related to an asset (ID, type, risk level, status). Use this for a lightweight overview when you don't need full alert data. Use this tool to: - Get a quick summary of alerts affecting an asset - List alert IDs, types, and risk levels without full details Returns: ServingLayerResponse: data with top 50 alerts summaries only.

get_asset_related_alerts_summary

Get an asset's related attack paths with full story AND graph data. Returns the top paths by risk score (default and max 5) with complete per-path data — the full hop-by-hop graph plus the story — and reports the full count in ``total_items``. Use this when you need the actual path contents. For a lightweight, text-only overview of many paths (IDs + stories, no graph data) use get_asset_related_attack_paths_summary. Returns: ServingLayerResponse: data with the asset's top attack paths (graph data + story).

get_asset_related_attack_paths

Get a summary of related attack paths for an asset. Returns only the top 50 attack paths (by risk score). Use total_items in the response for the full count Retrieves only the IDs and stories of attack paths related to an asset. Use this for a lightweight overview when you don't need full attack path data. Use this tool to: - Get a quick summary of attack paths affecting an asset - List attack path IDs and their stories without full details Returns: ServingLayerResponse: data with top 50 attack path IDs and stories only.

get_asset_related_attack_paths_summary

Find all assets containing malware matching a specific file hash signature. Searches across the entire asset inventory to identify assets infected with the same or similar malware based on SHA-256 file hash. Useful for incident response, malware outbreak tracking, and lateral movement analysis. Use this tool to: - Identify the scope of a malware infection across your environment - Find all assets compromised by the same malware sample - Support incident response and containment efforts - Track malware spread and lateral movement Example usage: - "Find all assets with malware hash a3f5b8c9d1e2f3..." - "Which systems have this malware sample?" - "Show me the infection scope for SHA-256 a3f5b8c9d1e2f3..." Returns: ServingLayerResponse: data with list of affected assets, their details, and malware detection metadata.

get_assets_with_similar_malware

Get attack path data and its story for a given attack path ID. Returns complete attack path information including: - Attack path metadata (risk score, exposure level, crown jewel details) - The attack flow stages (entry point, initial access, lateral movement, crown jewel) - Related assets and alerts along the path - The attack path story explaining how an adversary could exploit this path Use this tool when analyzing a specific attack path to understand: - How an attacker could reach critical assets (crown jewels) - What vulnerabilities or misconfigurations enable the attack - The risk level and exposure of the attack path - Remediation guidance to break the attack chain Returns: ServingLayerResponse: data with the attack path record and its story.

get_attack_path

Get Orca Business Units (BUs) data. A Business Unit is a saved scope of assets and findings defined by filters (for example: cloud providers, accounts/subscriptions, tags, asset types). BUs are used to: - Restrict visibility and access (RBAC) per team or org slice - Build dashboards and reports aligned to org structure - Scope alert routing and external integrations (e.g., Slack, Jira) Returns the Business Units payload (status and data with global/user filters).

get_business_units_data

Get CDR events grouped by event name with counts. This tool aggregates cloud audit logs and security events by event name, showing the count of each event type. Useful for understanding activity patterns and identifying the most frequent operations in your cloud environment. Use this tool to: - Get an overview of event types occurring in a time range - Identify the most frequent cloud operations - Analyze activity patterns by event type - Detect unusual spikes in specific event types Example usage: - "Show me event types from CloudTrail in the last 24 hours" - "What are the most common events by actor system:clouddns?" - "Group events by name for the last week" Returns: CdrEventsResponse: data with event names and their counts.

get_cdr_events_grouped_by_event_name

Check whether a CVE is known to Orca's CVE catalog, and see what it affects. For every vulnerability source that lists the CVE (each one is a "hit") you get the affected product and — when the source provides it — the vulnerable versions, the version that fixes it, and the security advisory ID (e.g. RHSA-2025:1746, GHSA-...). Usage Examples: - "Is CVE-2021-44228 in Orca's catalog?" - "Can Orca detect CVE-2021-44228 in my environment?" Returns: CveCatalogResponse: cve_id, detected (bool), and hits (section, product, vulnerable_versions, patched_versions, vendor_ids).

get_cve_from_catalog

Get code origin traceability data linking a runtime asset to its source code. Primarily for shift-left assets. Retrieves the complete code-to-cloud lineage, including source repositories, modules, and deployment pipelines that produced this asset. This enables shift-left security by connecting runtime findings back to source code. Use this tool to: - Trace assets back to their source code repositories - Identify responsible development teams and code owners - Map runtime security issues to specific code modules - Understand deployment provenance and build lineage Example usage: - "Where did this EC2 instance come from in the code?" - "Show me the code origin for asset c46cb523-30c2-1584-1aa0-5284e5b68222" - "Which repository deployed this resource?" Returns: ServingLayerResponse: data with code origin details including repositories, modules, commits, and deployment metadata.

get_code_origin

Get compliance analysis grouped by accounts or business units. Returns compliance scores broken down by framework and account/business unit. Useful for identifying which accounts or business units need the most attention for each compliance framework. Use this tool to: - Identify accounts or business units with the lowest compliance scores - Prioritize remediation efforts based on framework-specific compliance gaps - Understand the overall compliance posture across different organizational units Example usage: - "Show me the compliance analysis by business units" - "Which accounts have the lowest compliance scores for PCI DSS?" - "Get compliance analysis for all frameworks grouped by accounts" Returns: ComplianceHeatmapResponse with compliance scores broken down by framework and account/business unit. The data structure varies based on the group_by parameter (accounts or business_units). Each entry includes framework ID, score, and account/business unit details.

get_compliance_analysis_by_account_or_business_unit

Get detailed compliance framework control tests for a specific framework. Returns individual control/test results for a compliance framework, showing which controls are passing, failing, or unscored. Results are automatically sorted by alert severity (critical > high > medium > low > informational) to prioritize the most critical issues. By default, only failing control tests are returned (status_filter=['FAIL']) to focus on controls that need remediation. Use status_filter=['FAIL', 'PASS', 'UNSCORED'] to get all control test results. Use filters to scope the query by: - Cloud providers (e.g., ['aws', 'azure']) to see provider-specific violations - Accounts to focus on specific cloud accounts - Framework IDs to query multiple frameworks at once - Inventory tags to filter by asset tags Each control test result includes control ID, status, compliance score, alert counts by severity, affected asset counts, applicable providers, and UI URL for viewing in Orca's Compliance UI. Example usage: - "Show me failing controls for PCI DSS" - "What controls are failing for Azure accounts?" - "Get all controls (passing and failing) for AI Best Practices"

get_compliance_framework_control_tests

Get detailed compliance statistics for a specific framework and asset. Retrieves comprehensive compliance statistics including score percentage, pass/fail counts, and account-level data for a specific compliance framework applied to an asset. Use this tool to: - Get compliance score percentage for a framework - Review pass/fail test results breakdown - Analyze account-level compliance data - Identify specific compliance gaps Example usage: - "Show me orca_best_practices stats for asset vm_506464807365_i-073053e7a6d0567bf" - "What's the PCI DSS score for this EC2 instance?" - "Get detailed compliance stats for this asset" Returns: Dict with score data (avg_score_percent, test_results), accounts breakdown, and other framework-specific statistics.

get_compliance_framework_stats_for_asset

Get compliance score trend over time. Returns historical compliance scores showing how compliance posture has changed within the last N days. Each data point includes a date and the compliance score at that time. The default datetime_filter is 30 days. Use this tool to: - Track compliance score changes over time - Identify trends in compliance performance - Understand how compliance posture has evolved Example usage: - "Show me the compliance trend over time" - "What's the trend for PCI DSS compliance?" - "Get compliance trend for all frameworks" Returns: ComplianceTrendsResponse with compliance scores broken down by framework and date. The data structure includes a list of data points with date and score.

get_compliance_trend_over_time

Get alerts triggered by a specific compliance control test. Use this tool when users ask about alerts for a specific control, such as: - "What alerts are triggered by control 2.3.1?" - "Show me alerts for this control"

get_control_test_alerts

Get non-compliant and compliant assets for a specific compliance control test. Use this tool when users ask about assets failing or passing a specific control, such as: - "Which assets are failing control 2.3.1?" - "Show me non-compliant assets for this control" - "What assets pass this control?"

get_control_test_assets

Fetch the tenant's enabled compliance frameworks. The tool returns the list of enabled compliance frameworks with their metadata. Provide filter parameters to scope the query by accounts, providers, categories, frameworks, or other filters.

get_enabled_compliance_frameworks

Get assets that have compliance violations for a specific framework sorted by framework_failed_controls (descending - most failed controls first). Use this tool to: - Identify assets with the highest number of failed controls in a specific framework - Prioritize remediation efforts based on framework-specific compliance gaps - Understand the overall compliance posture across different assets Returns: ServingLayerResponse with assets that have compliance violations for the specified framework, including asset details, framework_failed_controls, and alert information. The data structure includes a list of assets with asset details, framework_failed_controls, and alert information.

get_framework_assets_with_failed_controls_count

Get Orca Integration Configs data. Integration configs define how data is sourced from various tools and systems. Each config includes: - Source type (e.g., Cloudtrail, Azure Monitor, etc.) - Data extraction methods - Configuration settings

get_integration_configs_data

Get detailed data for a specific linked entity type. Retrieves comprehensive data for entities of a specific type that are linked to the asset. This tool uses the LinkedEntity information from get_linked_entities_mapping to fetch detailed records for the related entities. Use this tool to: - Get detailed information about linked alerts - Retrieve compliance findings linked to the asset - Fetch vulnerability details for the asset - Access any entity type connected to the asset Example usage: - "Get details for all alerts linked to asset c46cb523-30c2-1584-1aa0-5284e5b68222" - "Show me the compliance findings for this asset" - "Fetch detailed vulnerability data for this EC2 instance" Returns: EnrichedServingLayerResponse: data with detailed records for the specified entity type, including relevant fields, relationships, and ui_url for each entity.

get_linked_entities_data

Get linked entities count mapping for an asset. Retrieves a mapping of all entities linked to the specified asset, along with their counts. This provides an complete and finite overview of the asset's relationships between different entity types (alerts, SensitiveData, SSHKeys, AuditRules, Addresses (domains), SecurityGroups, vulnerabilities, etc.). Use this tool to: - Discover what entities are connected to an asset - Get counts of linked alerts, AuditRules, and other entities - Understand the asset's relationship graph - Prepare for detailed entity data queries Example usage: - "Show me all linked entities for asset c46cb523-30c2-1584-1aa0-5284e5b68222" - "What are the IAM roles linked to this asset?" - "Show me alerts linked to this EC2 instance" Returns: LinkedEntitiesCountResponse: data with a mapping of linked entity types and their absolute total counts across all pages results.

get_linked_entities_mapping

Get other alerts for the same secret hash (data contains list of occurrences). Returns: ServingLayerResponse: data with alerts where the secret also occurs.

get_other_secret_occurrences

Get recommended compliance frameworks to enable based on connected cloud providers. Analyzes the tenant's connected cloud providers (AWS, Azure, GCP, etc.) and returns a list of currently inactive compliance frameworks that are relevant to those providers. This helps identify which frameworks should be enabled to start monitoring compliance for the tenant's cloud infrastructure. Returns frameworks such as CIS benchmarks, provider-specific best practices, and industry standards that match the detected cloud providers. Example usage: - "Which frameworks should I enable for my AWS account?" - "Show me recommended frameworks for Azure" - "What's the best framework to start with for GCP?" Returns: RecommendedFrameworksResponse containing: - frameworks: List of recommended compliance frameworks to enable - connected_providers: List of connected cloud provider names (e.g., ['aws', 'azure', 'gcp'])

get_recommended_compliance_frameworks_to_enable

Get compliance frameworks related to an asset. Retrieves the list of compliance frameworks that apply to the specified asset across multiple compliance standards (PCI DSS, HIPAA, SOC2, ISO 27001, etc.). Use this tool to: - Discover which compliance frameworks apply to an asset - Get framework IDs for detailed stats queries - Understand the asset's compliance coverage Example usage: - "What compliance frameworks apply to asset vm_506464807365_i-073053e7a6d0567bf?" - "Show me the related frameworks for this EC2 instance" - "Which compliance standards does this asset need to meet?" Returns: List of related frameworks and their basic information.

get_related_compliance_frameworks_for_asset

Get Source Code Management (SCM) posture alerts associated with an asset. Retrieves security findings and misconfigurations detected in code repositories and SCM platforms (GitHub, GitLab, Bitbucket, etc.) that are linked to this asset. Use this tool to: - Identify code security issues related to runtime assets - Review SCM misconfigurations and vulnerabilities - Trace security findings from code to cloud - Assess repository security posture Example usage: - "Show SCM alerts for asset c46cb523-30c2-1584-1aa0-5284e5b68222" - "What code security issues are related to this asset?" - "Check repository alerts for this VM" Returns: EnrichedServingLayerResponse: data with list of SCM posture alerts including severity, categories, remediation guidance, and ui_url for each entity.

get_scm_posture_alerts_on_asset

Fetch a single CDR (Cloud Detection and Response) event by its ID. This tool retrieves the full details of one specific cloud audit or security event when you already know its ID. Use this to drill into a single event rather than searching across many. Use this tool to: - Retrieve the complete details of a known event by its ID - Inspect an event referenced by an alert or another tool's output - Follow up on a specific event returned by search_cdr_events Example usage: - "Get CDR event abc123" - "Show me the details of event <id>" Returns: CdrSingleEventResponse: data containing the single matching event, or null data if not found.

get_single_cdr_event

Get Infrastructure-as-Code (IaC) Terraform lineage for an asset. Retrieves the complete Terraform module chain and resource definitions that created or manage this asset. Provides visibility into IaC configuration, module dependencies, and state management. Use this tool to: - Trace assets to their Terraform definitions - Identify Terraform modules and resources responsible for deployment - Review IaC configuration and dependencies - Enable security remediation at the IaC layer Example usage: - "Show me the Terraform chain for this S3 bucket" - "Which Terraform module created asset c46cb523-30c2-1584-1aa0-5284e5b68222?" - "Get the IaC configuration for this resource" Returns: ServingLayerResponse: data with Terraform modules, resources, variables, and configuration details.

get_terraform_chain

Fetch emerging threats and trending security news from Orca's threat intelligence feed. Use this tool to surface recently published vulnerabilities, active exploits, and security advisories that may affect the environment. Combine with asset or alert queries to answer "what's trending and am I exposed?". Use this tool to: - Discover newly published CVEs or threat campaigns - Search for specific vulnerabilities by keyword or CVE ID - Get a ranked list of the most impactful recent threats Example usage: - "what's trending am I exposed?" - "What are the latest trending threats?" - "Show me trending news about SSH vulnerabilities" - "Are there any critical trending threats I should be aware of?" Returns: TrendingNewsResponse: list of trending news items, each with id, headline, description, recommendation, cve_list, released, source, additional_sources, and exploits.

get_trending_news

Mark an asset as a crown jewel in Orca. Crown jewels are high-value assets whose protection is prioritized — marking an asset raises the priority of attack paths and alerts that touch it, focusing remediation where it matters most. What qualifies as a crown jewel has two layers: 1. Industry-standard signals — assets holding PII, financial data, intellectual property, secrets, or granting broad permissions. 2. Organizational criteria — the user or organization may define their own bar (e.g., "all production assets", "anything tagged Tier-1", "assets owned by the legal team"). When the user has stated such criteria, follow them; treat the industry signals above as the default when no organizational guidance is given. Use this tool whenever triage or user-stated criteria identify an asset as a crown jewel. To check whether an asset is already marked, use `get_asset_crown_jewel_info` first to avoid redundant marking. For `description`, prefer one of the predefined CrownJewelDescription categories ('Data: Personal identifiable information', 'Access: Broad permission access', 'Access: Secrets exposure', 'Data: Intellectual property', 'Data: Financial information', 'Other') — free text is accepted but reduces consistency across the platform. Returns: MarkAsCrownJewelResponse: Confirmation payload from the assets API. A successful return means the asset was marked as a crown jewel.

mark_asset_as_crown_jewel

Search CDR (Cloud Detection and Response) events with various filters. This tool queries cloud audit logs and security events from connected cloud providers (AWS CloudTrail, Azure Activity Log, GCP Audit Log, etc.). Use this to investigate security incidents, track user activities, and analyze cloud operations. Use this tool to: - Investigate suspicious activities by filtering on specific actors or IP addresses - Track specific cloud operations by event name - Search events within a specific time range - Analyze patterns in cloud audit logs Example usage: - "Show me CloudTrail events from the last 24 hours" - "Find events by actor system:clouddns" - "Search for CreateBucket events in the last week" - "Show events from IP address 10.0.0.1" Returns: CdrEventsResponse: data with matching CDR events including event details, actors, timestamps, and source information.

search_cdr_events

Temporarily suppress an Orca alert for `days` days; it reappears afterward. Use when remediation is planned but not yet executed, when awaiting further context, or to defer triage to a later date. For permanent dismissal, use `dismiss_alert` instead. Always populate `reason` (SnoozeReason enum) and a brief `justification` sentence for audit/compliance. Returns: AlertTimelineEvent: The resulting timeline event for the snooze action.

snooze_alert

Re-evaluate whether an Orca alert's underlying condition is still detected. Use after applying a remediation or fix to confirm the issue is resolved. Read-only — does not change the alert's status. If verification confirms the issue is gone, follow up with `update_alert_status` to set it Closed. Returns: AlertVerificationResponse: Confirmation payload from the verification request.

verify_alert