Orca Cloud Security Connector

The Orca Cloud Security Connector bridges Orca's CNAPP platform with Qualys' Enterprise TruRisk Platform by automatically ingesting cloud asset inventory and vulnerability findings through scheduled API calls.

The connector covers a range of workload types including Compute, Container Instances, Container Images, and Serverless environments. Security teams gain unified visibility across multi-cloud environments by consolidating Orca's agentless detection data with Qualys' risk scoring capabilities into a single asset inventory.

This integration removes the need for manual data translation between platforms, allowing SecOps teams to focus on remediating the most critical vulnerabilities rather than managing separate vendor consoles. By delivering enhanced risk context and prioritization through Qualys TruRisk, the connector supports more efficient resource allocation across modern cloud workloads.

Connector Details

Here is a comprehensive overview of what the Orca Cloud Security connector supports.

Vendor	Orca
Product Name	Orca Cloud Security
Category	Cloud Security
Asset Types Supported	Compute: AwsEc2Instance, GcpVmInstance, OciVMInstance Container Instances: AWS Container, GCP CloudRun Container Images: GCPGcrImage, AWSEcrImage, AzureAcrImage Serverless: AWSLambdaFunction, GCPCloudFunction, AzureFunction
Findings Supported	Yes
Supported Version & Type	SaaS (Latest)
Integration Type	API Integration (REST / GraphQL)
Direction	Unidirectional (Orca to Qualys)
Incremental Sync (Delta)	Not Supported
Import of Installed Software	Not Supported
Import of Source Tags	Not Supported

Connection Settings

User Roles and Permissions

To retrieve assets and vulnerability findings, the Orca Cloud Security connector uses the Orca Serving-layer APIs.

You must generate an API token with sufficient permissions before configuring the connector.

• You can use the built-in Viewer role provided by Orca.
• Alternatively, you can create a custom role with the minimum permissions required to access: HostAssets and VulnerabilitiesV2.

Reference: Default Roles and Permissions (Orca)

How to create an API token for Orca Cloud Security connector:

1. Login to Orca account using the domain URL specific to your region.
2. Navigate to  Settings > Users & Permissions > API.
3. Click Create API Token.
4. Define the following API token settings:
   1. Name: Enter a unique name for the API token. 
   2. Description: Describe the API token.
   3. Never Expire: To create a token that is permanently valid, select this checkbox. 
   4. Expiration: Set the token's expiration date. This option is available if the Never Expire checkbox is deselected. The expired tokens are still available but invalid, and the integrations that use them do not work. 
   5. Service Token: If applicable, select this checkbox to indicate that the created token is a service token.
      Service tokens are not linked to a specific user. They are scoped according to the user who created them. Even if the user is removed, service tokens can still be used, but they are invalid for the organization.
   6. Role: Select the role that best defines the permissions required by the token.
      See Default Roles and Permissions (Requires Orca support login).
      You need the following permissions before creating the API token.

Authentication Details

Provide the following values on the connector configuration screen.

Name	Key	Type	Description
API Token	api_token	Encrypted String	API token generated from Orca Cloud Security
Domain	domain	String	Orca API domain based on region (for example: api.orcasecurity.io, app.eu.orcasecurity.io)

Use the domain based on your region. See supported domains below:

US (Default)	https://api.orcasecurity.io/api/
Europe	https://app.eu.orcasecurity.io/api/
Australia	https://app.au.orcasecurity.io/api/
India	https://app.in.orcasecurity.io/api/
Israel	https://api.il.orcasecurity.io/api/
Brazil (SA)	https://api.sa.orcasecurity.io/api/

Connector Configuration

Basic Details

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the Orca Cloud Security Connector and click Manage.
4. Provide a connector Name and Description.
5. Enter the required authentication details.

Schedule

Schedules control when the connector executes and what data is ingested.

• Select the execution frequency.
• Select the supported Asset Types.
• Select Vulnerability findings for ingestion.

Asset Identification Rules

Identification Rules are predefined precedence rules provided by Qualys CSAM. These rules determine how imported findings are associated with assets in ETM.

Identification Rules apply only to compute assets. Other asset classes are not affected.

You can proceed without modifying these rules.

How Does the Connection Work?

On schedule (or on demand), the Orca Cloud Security connector retrieves supported cloud asset classes and vulnerability findings from Orca and imports them into ETM Unified Asset Inventory.

Each execution performs a full data pull.

In the Connector screen, the connector transitions through the following states:

• Registered – Connector is created.
• Scheduled – Connector is queued for execution.
• Processing – Assets and findings are being fetched.
• Processed – Assets are imported; findings may continue processing.

The full ingestion process may take several hours depending on data volume.

Viewing Assets and Findings in ETM

After ingestion, view Orca Cloud assets in ETM Unified Asset Inventory.

• Assets: Enterprise TruRisk Management > Inventory > Assets > All Assets.
  Use the tag or asset filter: tags.name:"Orca Security" or asset.inventory:"Orca Cloud Security".
  
• Findings: Enterprise TruRisk Management > Risk Management > Findings > Vulnerability.
  Use the vendor filter: findings.vendorProductname:"Orca Cloud Security".
  

You can click on any findings to open a detailed view.

Orca Cloud Security - Transformation Map

The default transformation map for different asset classes, configured for the Orca Cloud Security connector is fetched from the database and utilized during the execution of the connector profile to perform data transformation.

Compute

AWS EC2 instanceAWS EC2 instance

GCP VM InstanceGCP VM Instance

OCI VM InstanceOCI VM Instance

Container ImageContainer Image

Container Instance

AWS ContainerAWS Container

GCP CloudRunGCP CloudRun

Serverless

AWS Lambda FunctionAWS Lambda Function

GCP Cloud FunctionGCP Cloud Function

Azure Function AppAzure Function App