Orca Security V2 Connector

Before configuring the connector in Qualys ETM, ensure you have the following ready:

1. Ensure you have access to your Orca Security account with permissions to create API tokens.
2. Determine the role to assign to the API token – either the built-in Viewer role or a custom role with the minimum required permissions (see the Permissions section below).
3. Generate an API token in Orca. Navigate to Settings > Users & Permissions > API and click Create API Token. Save the token immediately – it cannot be accessed again after clicking Continue.

Generating an API Token in Orca

Follow these steps to create an API token in your Orca Security environment:

1. Log in to your Orca environment using your regional domain.
2. Navigate to Settings > Users & Permissions > API.
3. Click Create API Token.
4. Provide a Name and Description for the token.
5. Select an expiration option: Never Expire or a specific Expiration Date.
6. Select the required Role: the built-in Viewer role, or a custom role with the minimum required permissions.
7. Optionally configure Scope to restrict data access to specific Accounts, Business Units, or Shift Left Projects.

   Note: Restricting the token's scope means data is fetched only for the selected scope (Accounts, Business Units, Shift Left Projects). If you require unrestricted data flow, do not select any scope restriction checkbox.

8. Click Add, then click Continue.

Permissions Required

You may use the built-in Viewer role, which provides the necessary read permissions for assets and vulnerabilities. Alternatively, create a custom role with the following minimum permissions:

Required Permissions

The connector uses Orca’s Serving-Layer APIs to fetch:

• Host Assets
• VulnerabilityV2 findings

You may use the out-of-the-box Viewer role, which provides the necessary read permissions, such as

• View/List only

• Assets - View asset information

• Cloud account - View cloud account information

• Domain - View Domains information

• Jira - View tickets

• Compliance - View checks foundation benchmark standards for AWS, GCP, and Azure

• CVE's - View Common Vulnerabilities and Exposures

• Sonar actions - Query and Update Rules

• Read-only access to all Shift-Left related resources

Or, you can create a custom role with the following minimum required permissions. Read more at Default Roles and Permissions (Requires Orca support login).

Risk Permissions	Asset Permissions

 Keep in mind that restricting the token's scope means that data is fetched only for the selected scope. If you require unrestricted data flow, we recommend not selecting the checkbox.

Scope and Data Access

The connector uses Orca's Serving-Layer query API to retrieve assets and vulnerabilities. Asset retrieval covers six cloud provider types: AwsEc2Instance, AzureComputeVm, GcpVmInstance, OciComputeVmInstance, VmwareVmInstance, and AliCloudEcsInstance. Vulnerability retrieval uses the VulnerabilityV2 model. The API rate limit is 1 request per second per user. Filters and query support are not available. Import of installed software is supported with a maximum of 200 entries per asset. Import of source tags is supported with a maximum of 200 tags per asset. The data flow is unidirectional, from Orca Security to Qualys ETM.

Key Rotation

If you rotate or regenerate your Orca API token, update the API Token field in the connector's Profile & Connectivity configuration in Qualys ETM immediately to prevent authentication failures. Confirm the new token has not expired and retains the required role permissions before saving.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integrations.
3. Locate Orca Security V2 and click Manage.

Configure the connector's identity and authenticate with the Orca Security source system. A valid connection test is required before proceeding to the next step.

Connector Details

Authentication Details

After entering your credentials, click Test Connection. The following checks are performed:

• Network Reachability — Verifies the API endpoint is reachable.
• TLS Handshake — Confirms a secure connection can be established.
• Authentication Credential Check — Validates the Client ID, Client Secret, and Token URL.
• Authorization Scope Check — Confirms the service account has the required permissions.
• Data Fetch — Verifies that data can be retrieved from the Orca Security API.

All five checks must pass before you can proceed to Step 2. If any check fails, refer to the Troubleshooting section for resolution steps.

Configure what data to synchronize and how frequently the connector runs. The connector pulls Vulnerability Findings (CVEs) for Host Assets.

Set a Single Occurrence or a Recurring schedule to control when the connector executes. Each scheduled run performs a full data pull from Orca Security; delta synchronization is not supported.

Fields marked with * require date/value transformation before mapping. (Required) denotes mandatory target fields in the Qualys ETM schema.