Orca Cloud Security Connector

The table shows supported (✓), unsupported (—), and vendor-not-supported (NA) asset classes and finding types across AWS, Azure, GCP, and OCI.

✓ = Supported.
 NA = Vendor does not support this.
The Resource Type row shows the specific cloud service targeted for each asset class. 

In the table below, "—" entries indicate the asset class/finding type combination is not yet available for this. NA indicates that the vendor is currently not supporting this asset class/finding type combination.

The connector authenticates to Orca using an API token. Before you begin, ensure you have the required token and your regional domain URL.

Permissions Required

To retrieve assets and vulnerability findings, the connector uses Orca's Serving-layer APIs. Your API token must be assigned one of the following:

• The built-in Viewer role (recommended - available out of the box in Orca).
• A custom role with at minimum: HostAssets, VulnerabilitiesV2, and Risks > Alerts (Read) permissions (required for fetching misconfigurations).

Reference: Default Roles and Permissions (Orca)

Before creating an API token, make sure you have the following permissions:

To ingest assets and vulnerabilities, the Orca platform connector uses the Orca platform Serving Layer APIs. To ensure that the Orca connector runs smoothly, users must create an API token with a role that includes the permissions listed below.

Users can create an API token with the Viewer role. This role is provided by the Orca platform out of the box and includes the following permissions:

For Host Assets and Vulnerabilities V2:

Viewer PermissionsViewer Permissions

Orca document link : https://docs.orcasecurity.io/v1/docs/default-roles-and-permissions#:~:text=via%20Orca%20CLI-,Viewer,-View/List%20only

Misconfigurations:

To fetch misconfigurations, the following permissions are required:

• If you only need to fetch alerts (GET), make sure that the token's role includes the Risks > Alerts (Read) permission.
• Risks > Alerts > Alerts Read: This permission is required to view alerts in the UI and fetch alerts by using the Alerts service-layer API.

Generate an API Token in Orca

Copy and save your token immediately. You cannot retrieve it again after clicking Continue. 

1. Log in to your Orca account using the domain URL for your region.
2. Navigate to Settings > Users & Permissions > API.
3. Click Create API Token.
4. Configure the token settings:
   • Name — Enter a unique name for the token.
   • Description — Describe the token's purpose.
   • Never Expire — Select this checkbox to create a permanently valid token. If deselected, set an Expiration date. Expired tokens remain visible but become invalid; integrations using them will stop working.
   • Service Token — Select this checkbox if the token should not be tied to a specific user. Service tokens remain usable even if the creating user is removed, but they are scoped to that user's permissions at creation time.
   • Role — Select the role that grants the required permissions. See Default Roles and Permissions.
   • Scope (optional) — To restrict data fetching to specific resources, enable Scope access to specific resources and select from Accounts, Business Units, or Shift Left Projects.

      Restricting the scope limits the data fetched to the selected resources only. For unrestricted data flow, leave the scope checkbox deselected.

5. Click Add. The Integration API Token window is displayed.
6. Click Continue. 

Authentication Details

You will need the following values when configuring the connector in ETM.

Use the domain that corresponds to your deployment region:

1. Log in to Qualys ETM  and navigate to Connectors > Integration.
2. Locate the Orca Cloud Security Connector on the Connector Marketplace and click Add. This is a one-time task.

   If the connector is already added to your account, navigate to My Connectors and search for the Orca Cloud Security connector.

3. Click Manage Connections on the connector tile.
4. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. 
5. Click Proceed to Setup. 
6. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector.
   Description	An optional description of the connection's purpose.
   Preserve Findings Missing in Latest Sync	When enabled, findings not returned in the latest sync will remain open and unchanged.
   Preserve Findings State if Assets are Missing	When enabled, findings state will be preserved during sync if assets are missing.

   Authentication Details

   Provide the following values to authenticate the connector with your Wiz environment.

   Field	Type	Description
   Domain (required)	String	Provide the Domian detils for API connection.
   API Token (required)	String	Provide the API token for API connection.

   
   
7. Click Test Connection. A modal will appear showing the status of each connectivity check. Resolve any errors before proceeding.
   • Network Reachability — Verifies the API endpoint is reachable.
   • TLS Handshake — Confirms a secure connection can be established.
   • Authentication Credential Check — Validates the Client ID, Client Secret, and Token URL.
   • Authorization Scope Check — Confirms the service account has the required permissions.
   • Data Fetch — Verifies that data can be retrieved from the Orca Security API.
     
     
8. Click Next once the test is successful.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — Select one of the following options:
   • Assets & Findings — By default, the connector ingests all supported asset classes and all finding types (Vulnerabilities and Misconfigurations). To limit ingestion to specific asset classes or finding types, enable the Advanced Settings toggle. 
   • Assets — Ingests asset records only, without findings.

The Info icon identifies the default selections for Asset Types and Findings used in data mapping. To change these selections, go to Advanced Settings > Filters, and then configure Asset Types and Findings as needed.

2. Advanced Settings (optional) — Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest into ETM.
3. Schedule — Under the Schedule section, select an execution frequency from the Occurs dropdown (for example, Daily). The system will display the calculated start date, end date, and timezone for the scheduled run. The schedule configuration supports recurring synchronization, such as Daily.

Advanced Settings

Enabling the Advanced Settings toggle exposes additional configuration options for data filtering, staging behavior, and field mapping.

Filters

Use the Filters tab to restrict which asset types and findings are ingested.

Review the configuration summary and click Create to finalize the connection.