Orca Connector User Guide
Summary: How to set up and use the Orca connector in Ivanti Neurons for RBVM.
This article describes an integration currently in Beta. If you have an interest in joining the program, please contact support.
Overview
Ivanti Neurons for RBVM and ASPM provides an API-based connector that integrates with Orca. This integration enables customers to bring to gain visibility into their overall cloud security and achieve a simplified and efficient way to manage vulnerabilities. Users can configure the connector to pull scan data from Orca on a periodic basis as well.
Orca assets can appear as either hosts or applications. Refer to the data mapping section below for details.
Connector Configuration
Prerequisites
- Requires an active subscription to Ivanti Neurons for RBVM/ASPM.
- Requires an active subscription to Orca.
- The region for your Orca instance
Connections
The following API calls are performed during a connector run to pull security vulnerabilities from Orca into Ivanti Neurons for RBVM. The connector initially calls /api/serving-layer/query to find asset types and set up an export of assets and vulnerabilities.
The endpoint api/sonar/query has been deprecated and the new endpoint api/serving-layer/query should be used now.
Throttling Limits
Orca applies throttling limits to the following APIs:
Serving Layer endpoints
For the /serving-layer/ endpoints, including /serving-layer/query:
Each user can make 2 requests per second.
All users in an organization can make up to 100,000 requests per day.
The same daily limits apply to both GET and POST requests.
Scan Logs endpoints
The limit is 1,000 requests per hour per token or user.
All users in an organization can make up to 5,000 requests per hour.
Other API endpoints:
The default limit is 50 requests per second per token or user.
Upon request, this limit can be adjusted so that specific endpoints have different limits. The maximum allowed limit is 300 requests per second.
The same daily limits apply to GET and POST requests.
Platform Setup
When logged into the platform, navigate to the Automate > Integrations page.
Using the search bar in the upper-right corner of the Integrations page, type Orca to find the connector cards. Locate the one you need and click CONFIGURATION. (Note: Regardless of which card you select, you will have the opportunity to configure the connector for both hosts and applications.)
Complete the following required fields. These fields include:
- Connector Name: Connector name for the Ivanti Neurons platform.
- Region: Dropdown used to select you region and the URL associated with it
- Secret Key: Orca user credentials
- Network: Network name in Ivanti Neurons. Ingested assets and findings will be associated with this network.
Once the fields have been filled out, click Test Credentials to ensure the connector can connect to the Orca instance.
Additional connector configurations, such as Schedule and Optional Configurations, can be set up next.
Optional Configurations
- Which data types should be ingested? In this section, you can choose whether or not to ingest certain types of assets.
Once the connector configuration is complete, click the Save button.
When the connector is set up, a new entry for it appears at the top of the Integrations page. This connector runs once the initial setup is complete. Check the connector’s status by clicking the History button.
Editing a Connector Configuration
Connector configurations can be updated at any time after creation. Go to the Automate > Integrations page and select the specific connector you want to update.
Utilizing the Connector
The data from a Orca scan file can be ingested as either host findings or application findings (depending on the asset type). Hosts and host findings have the scanner name ORCAHOST. Applications and application findings have the scanner name ORCAAPP. Scanner Name can be used as a filter any page showing assets or findings.
Assets
Asset data can appear on either the Hosts page or the Applications page. In either case, the Scanner Specific Information section of the detail pane shows the asset properties reported by Orca.
Example: In the Application Summary pane under the Scanner Specific Information section, the scanner is listed as ORCAAPP.
Findings
Depending on the source’s asset type, findings can appear either on the Host Findings or Application Findings. Filter or do a Group By on Scanner Name to locate them.
Severity Mapping
Orca reports severity on the same 0.0-10.0 scale used by Ivanti Neurons with no modification.
Host Mapping
|
RBVM Field |
Mapping Field |
|---|---|
|
Plugin ID |
data.AssetUniqueId.value |
|
Host Name |
data.Type.value |
|
ID |
id |
|
First Discovered On |
data.FirstSeen |
|
Last Discovered On |
data.LastSeen |
|
ORCAHOST Inventory Category |
data.Category.value |
|
ORCAHOST Inventory ConsoleUrlLink |
data.ConsoleUrlLink.value |
|
ORCAHOST Inventory Exposure |
data.Exposure.value |
|
ORCAHOST Inventory IsInternetFacing |
data.IsInternetFacing.value |
|
ORCAHOST Inventory NewCategory |
data.NewCategory.value |
|
ORCAHOST Inventory NewSubCategory |
data.NewSubCategory.value |
|
ORCAHOST Inventory OrcaScore |
data.OrcaScore.value |
|
ORCAHOST Inventory Region |
data.Region.value |
|
ORCAHOST Inventory RiskLevel |
data.RiskLevel.value |
|
ORCAHOST Inventory Score |
data.Score.value |
|
ORCAHOST Inventory State |
data.State.value |
|
ORCAHOST Inventory Status |
data.Status.value |
|
ORCAHOST Inventory SubCategory |
data.SubCategory.value |
|
ORCAHOST Inventory UiUniqueField |
data.UiUniqueField.value |
|
ORCAHOST Inventory CreationTime |
data.CreationTime.value |
|
ORCAHOST Inventory Observations |
data.Observations.value |
|
ORCAHOST Inventory RelatedCompliances |
data.RelatedCompliances.value |
|
ORCAHOST Inventory Zones |
data.Zones.value |
|
PluginId |
data.RuleId.value |
|
Title |
data.AlertType.value |
|
First Discovered On |
data.CreatedAt |
|
Last Discovered On |
data.LastSeen |
|
Scanner Reported Severity |
data.Score.value |
|
Severity |
data.Score.value |
|
Scanner Unique Id |
data.id |
|
ORCAHOST Alert Id |
data.AlertId.value |
|
ORCAHOST Alert Source |
data.AlertSource.value |
|
ORCAHOST Category |
data.Category.value |
|
ORCAHOST |
data.Category.value |
|
ORCAHOST |
data.CommentsCount.value |
|
ORCAHOST CVE Exploit Available |
data.CVEExploitAvailable.value |
|
ORCAHOST CVE Fix Available |
data.CveFixAvailable |
|
ORCAHOST Hostname |
data.Hostname |
|
ORCAHOST Is Live |
data.IsLive.value |
|
ORCAHOST Max CVSS Score |
data.MaxCvssScore |
|
ORCAHOST Orca Score |
data.Name.value |
|
ORCAHOST Orca Score |
data.OrcaScore.value |
|
ORCAHOST Risk Level |
data.RiskLevel.value |
|
ORCAHOST |
data.RuleSource.value |
|
ORCAHOST Rule Type |
data.RuleType.value |
|
ORCAHOST Alert Severity |
data.Severity.value |
|
ORCAHOST Alert Source |
data.AlertSource.value |
|
ORCAHOST Last Updated |
data.LastUpdated |
|
ORCAHOST Labels |
data.Labels.value |
|
ORCAHOST RelatedCompliance |
data.RelatedCompliances.value |
|
ORCAHOST Finding name |
data.Inventory.data.Name.value |
|
ORCAHOST Inventory type |
data.Inventory.data.Type.value |
Application Mappings
|
RBVM Field |
Mapping Field |
|---|---|
|
Plugin ID |
data.AssetUniqueId.value |
|
Application Name |
data.Type.value |
|
ID |
id |
|
First Discovered On |
data.FirstSeen |
|
Last Discovered On |
data.LastSeen |
|
ORCAAPP Category |
data.Category.value |
|
ORCAAPP ConsoleUrlLink |
data.ConsoleUrlLink.value |
|
ORCAAPP Exposure |
data.Exposure.value |
|
ORCAAPP IsInternetFacing |
data.IsInternetFacing.value |
|
ORCAAPP NewCategory |
data.NewCategory.value |
|
ORCAAPP NewSubCategory |
data.NewSubCategory.value |
|
ORCAAPP OrcaScore |
data.OrcaScore.value |
|
ORCAAPP Region |
data.Region.value |
|
ORCAAPP RiskLevel |
data.RiskLevel.value |
|
ORCAAPP Score |
data.Score.value |
|
ORCAAPP State |
data.State.value |
|
ORCAAPP Status |
data.Status.value |
|
ORCAAPP SubCategory |
data.SubCategory.value |
|
ORCAAPP Inventory UiUniqueField |
data.UiUniqueField.value |
|
ORCAAPP CreationTime |
data.CreationTime.value |
|
ORCAAPP UpdatedTime |
data.UpdatedTime |
|
ORCAAPP Observations |
data.Observations.value |
|
ORCAAPP RelatedCompliances |
data.RelatedCompliances.value |
|
ORCAAPP Zones |
data.Zones.value |
|
ORCAAPP Compute Regions |
data.Region.value |
|
Plugin ID |
data.RuleId.value |
|
Title |
data.AlertType.value |
|
First Discovered On |
data.CreatedAt |
|
Last Discovered On |
data.LastSeen |
|
Scanner Reported Severity |
data.Score.value |
|
Severity |
data.Score.value |
|
Scanner Unique Id |
data.id |
|
ORCAAPP Alert Id |
data.AlertId.value |
|
ORCAAPP Alert Source |
data.AlertSource.value |
|
ORCAAPP Category |
data.Category.value |
|
ORCAAPP Is Live |
data.IsLive.value |
|
ORCAAPP Orca Score |
data.OrcaScore.value |
|
ORCAAPP Risk Level |
data.RiskLevel.value |
|
ORCAAPP Risk Source |
data.RuleSource.value |
|
ORCAAPP Rule Type |
data.RuleType.value |
|
ORCAAPP Alert Severity |
data.Severity.value |
|
ORCAAPP Alert Source |
data.AlertSource.value |
|
ORCAAPP Last Updated Time |
data.LastUpdatedTime |
|
ORCAAPP Labels |
data.Labels.value |
|
ORCAAPP RelatedCompliance |
data.RelatedCompliances.value |
|
ORCAAPP Inventory type |
data.Inventory.data.Type.value |