Orca Connector User Guide

Summary: How to set up and use the Orca connector in Ivanti Neurons for RBVM.

Ivanti Neurons for RBVM and ASPM provides an API-based connector that integrates with Orca. This integration enables customers to bring to gain visibility into their overall cloud security and achieve a simplified and efficient way to manage vulnerabilities. Users can configure the connector to pull scan data from Orca on a periodic basis as well.

Orca assets can appear as either hosts or applications. Refer to the data mapping section below for details.

The following API calls are performed during a connector run to pull security vulnerabilities from Orca into Ivanti Neurons for RBVM. The connector initially calls /api/serving-layer/query to find asset types and set up an export of assets and vulnerabilities.

Orca applies throttling limits to the following APIs:

Serving Layer endpoints

For the /serving-layer/ endpoints, including /serving-layer/query:

Scan Logs endpoints

Other API endpoints: 

When logged into the platform, navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type Orca to find the connector cards. Locate the one you need and click CONFIGURATION. (Note: Regardless of which card you select, you will have the opportunity to configure the connector for both hosts and applications.)

Complete the following required fields. These fields include:

Once the fields have been filled out, click Test Credentials to ensure the connector can connect to the Orca instance.

Additional connector configurations, such as Schedule and Optional Configurations, can be set up next.

Once the connector configuration is complete, click the Save button.

When the connector is set up, a new entry for it appears at the top of the Integrations page. This connector runs once the initial setup is complete. Check the connector’s status by clicking the History button.

Connector configurations can be updated at any time after creation. Go to the Automate > Integrations page and select the specific connector you want to update.

The data from a Orca scan file can be ingested as either host findings or application findings (depending on the asset type). Hosts and host findings have the scanner name ORCAHOST. Applications and application findings have the scanner name ORCAAPP. Scanner Name can be used as a filter any page showing assets or findings.

Asset data can appear on either the Hosts page or the Applications page. In either case, the Scanner Specific Information section of the detail pane shows the asset properties reported by Orca.

Example: In the Application Summary pane under the Scanner Specific Information section, the scanner is listed as ORCAAPP.

Depending on the source’s asset type, findings can appear either on the Host Findings or Application Findings. Filter or do a Group By on Scanner Name to locate them.

Orca reports severity on the same 0.0-10.0 scale used by Ivanti Neurons with no modification.