Orca Cloud Security Connector

The connector authenticates to Orca using an API token. Before you begin, ensure you have the required token and your regional domain URL.

Permissions Required

To retrieve assets and vulnerability findings, the connector uses Orca's Serving-layer APIs. Your API token must be assigned one of the following:

• The built-in Viewer role (recommended — available out of the box in Orca).
• A custom role with at minimum: HostAssets, VulnerabilitiesV2, and Risks > Alerts (Read) permissions (required for fetching misconfigurations).

Reference: Default Roles and Permissions (Orca)

Generate an API Token in Orca

1. Log in to your Orca account using the domain URL for your region.
2. Navigate to Settings > Users & Permissions > API.
3. Click Create API Token.
4. Configure the token settings:
   1. Name — Enter a unique name for the token.
   2. Description — Describe the token's purpose.
   3. Never Expire — Select this checkbox to create a permanently valid token. If deselected, set an Expiration date. Expired tokens remain visible but become invalid; integrations using them will stop working.
   4. Service Token — Select this checkbox if the token should not be tied to a specific user. Service tokens remain usable even if the creating user is removed, but they are scoped to that user's permissions at creation time.
   5. Role — Select the role that grants the required permissions. See Default Roles and Permissions.
   6. Scope (optional) — To restrict data fetching to specific resources, enable Scope access to specific resources and select from Accounts, Business Units, or Shift Left Projects.

      Note: Restricting scope limits data fetched to the selected resources only. For unrestricted data flow, leave the scope checkbox deselected.

5. Click Add. The Integration API Token window appears.
6. Click Continue.

Important: Copy and save your token immediately. You cannot retrieve it again after clicking Continue.

Authentication Details

You will need the following values when configuring the connector in ETM.

Use the domain that corresponds to your deployment region:

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the Orca Cloud Security Connector on the Connector Marketplace and click Add. This is a one-time task.

   If the connector is already added to your account, navigate to My Connectors and search for the Orca Cloud Security connector.

4. Click Manage Connections on the connector tile.
   1. Click Create Connection and follow the setup wizard:
      1. Click Proceed to Setup.
      2. On the Profile & Connectivity page, enter a connector Name.
      3. Enter your Authentication Details (API Token and Domain from the Authentication step).
      4. Click Test Connection. A modal will appear showing the status of each connectivity check. Resolve any errors before proceeding.
         1. Network Reachability — Verifies the API endpoint is reachable.
         2. TLS Handshake — Confirms a secure connection can be established.
         3. Authentication Credential Check — Validates the Client ID, Client Secret, and Token URL.
         4. Authorization Scope Check — Confirms the service account has the required permissions.
         5. Data Fetch — Verifies that data can be retrieved from the Orca Security API.
            
      5. Click Next once the test is successful.

1. Asset Classes and Findings — By default, the connector ingests all supported asset classes and all finding types (Vulnerabilities and Misconfigurations). To limit ingestion to specific asset classes or finding types, enable the Advanced Settings toggle. See Advanced Settings below.
2. Schedule — Select an execution frequency from the Schedule dropdown.

   A custom schedule option becomes available only after enabling the Advanced Settings toggle. To define one, select Custom from the dropdown and enter your desired schedule expression.

3. Review the configuration summary and click Create to finalize the connection.