---
title: Orca Connector User Guide
slug: rbvm-help/orca-connector-user-guide
createdAt: 2026-10-26T13:51:22.859Z
---

Summary: How to set up and use the Orca connector in Ivanti Neurons for RBVM.

:::hint{type="info"}
This article describes an integration currently in Beta. If you have an interest in joining the program, please contact support.
:::

## Overview

Ivanti Neurons for RBVM and ASPM provides an API-based connector that integrates with **Orca**. This integration enables customers to bring to gain visibility into their overall cloud security and achieve a simplified and efficient way to manage vulnerabilities. Users can configure the connector to pull scan data from Orca on a periodic basis as well.

Orca assets can appear as either hosts or applications. Refer to the data mapping section below for details.

## Connector Configuration

### Prerequisites

- Requires an active subscription to Ivanti Neurons for RBVM/ASPM.
- Requires an active subscription to Orca.
- The region for your Orca instance

### Connections

The following API calls are performed during a connector run to pull security vulnerabilities from Orca into Ivanti Neurons for RBVM. The connector initially calls /api/serving-layer/query to find asset types and set up an export of assets and vulnerabilities.

:::hint{type="info"}
The endpoint api/sonar/query has been deprecated and the new endpoint api/serving-layer/query should be used now.
:::

### Throttling Limits

Orca applies throttling limits to the following APIs:

**Serving Layer endpoints**

For the **/serving-layer/** endpoints, including **/serving-layer/query**:

- Each user can make 2 requests per second.
- All users in an organization can make up to 100,000 requests per day.
- The same daily limits apply to both **GET** and **POST** requests.

**Scan Logs endpoints**

- The limit is 1,000 requests per hour per token or user.
- All users in an organization can make up to 5,000 requests per hour.

**Other API endpoints**: 

- The default limit is 50 requests per second per token or user.
- Upon request, this limit can be adjusted so that specific endpoints have different limits. The maximum allowed limit is 300 requests per second.
- The same daily limits apply to **GET** and **POST** requests.

### Platform Setup

When logged into the platform, navigate to the **Automate > Integrations** page.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/0CQkn32MxY5RTFX_WW-hU_orca-integrations.png" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/Orca - Integrations.png" githubPath="RBVM_14.70_help/Resources/Images/Orca - Integrations.png" showCaption="false"}

Using the search bar in the upper-right corner of the **Integrations** page, type **Orca** to find the connector cards. Locate the one you need and click **CONFIGURATION**. (Note: Regardless of which card you select, you will have the opportunity to configure the connector for both hosts and applications.)

![](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/n_fYkniZFaOc4RpL8vXgm_orca-add-new.png)

Complete the following required fields. These fields include:

- **Connector Name**: Connector name for the Ivanti Neurons platform.
- **Region**: Dropdown used to select you region and the URL associated with it
- **Secret Key**: Orca user credentials
- **Network**: Network name in Ivanti Neurons. Ingested assets and findings will be associated with this network.

![](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/rMkazuiH5Q9eUcF9q9Kh6_orca-connection.png)

Once the fields have been filled out, click **Test Credentials** to ensure the connector can connect to the Orca instance.

Additional connector configurations, such as **Schedule** and **Optional Configurations**, can be set up next.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/9vv11MYMYAHVAy3yWXrNs_orca-schedule.png" position="flex-start" size="69" width="480" height="149" initialPath="Resources/Images/Orca - Schedule.png" githubPath="RBVM_14.70_help/Resources/Images/Orca - Schedule.png" showCaption="false"}

### Optional Configurations

- **Which data types should be ingested**? In this section, you can choose whether or not to ingest certain types of assets.

Once the connector configuration is complete, click the **Save** button.

![](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/IKQnJwSm-DnoUNzWpkGP4_orca-optional.png)

When the connector is set up, a new entry for it appears at the top of the **Integrations** page. This connector runs once the initial setup is complete. Check the connector’s status by clicking the **History** button.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/eS2_IvAcK2kr0OSRmd1DT_orca-history-button.png" position="flex-start" size="33" width="232" height="86" initialPath="Resources/Images/Orca - History Button.png" githubPath="RBVM_14.70_help/Resources/Images/Orca - History Button.png" showCaption="false"}

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/UyBNSH242qVtNw1g9SjHR_orca-history.png" position="flex-start" size="72" width="501" height="203" initialPath="Resources/Images/Orca - History.png" githubPath="RBVM_14.70_help/Resources/Images/Orca - History.png" showCaption="false"}

### Editing a Connector Configuration

Connector configurations can be updated at any time after creation. Go to the **Automate > Integrations** page and select the specific connector you want to update.

## Utilizing the Connector

The data from a Orca scan file can be ingested as either host findings or application findings (depending on the asset type). Hosts and host findings have the scanner name ORCAHOST. Applications and application findings have the scanner name ORCAAPP. Scanner Name can be used as a filter any page showing assets or findings.

### Assets

Asset data can appear on either the Hosts page or the Applications page. In either case, the Scanner Specific Information section of the detail pane shows the asset properties reported by Orca.

Example: In the **Application Summary** pane under the **Scanner Specific Information** section, the scanner is listed as **ORCAAPP**.

![](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/KvbwB8EJjSdC7z7Owy7Vc_orca-assets.png)

### Findings

Depending on the source’s asset type, findings can appear either on the Host Findings or Application Findings. Filter or do a Group By on Scanner Name to locate them.

### Severity Mapping

Orca reports severity on the same 0.0-10.0 scale used by Ivanti Neurons with no modification.

### Host Mapping

| **RBVM Field**                        | **Mapping Field**              |
| ------------------------------------- | ------------------------------ |
| Plugin ID                             | data.AssetUniqueId.value       |
| Host Name                             | data.Type.value                |
| ID                                    | id                             |
| First Discovered On                   | data.FirstSeen                 |
| Last Discovered On                    | data.LastSeen                  |
| ORCAHOST Inventory Category           | data.Category.value            |
| ORCAHOST Inventory ConsoleUrlLink     | data.ConsoleUrlLink.value      |
| ORCAHOST Inventory Exposure           | data.Exposure.value            |
| ORCAHOST Inventory IsInternetFacing   | data.IsInternetFacing.value    |
| ORCAHOST Inventory NewCategory        | data.NewCategory.value         |
| ORCAHOST Inventory NewSubCategory     | data.NewSubCategory.value      |
| ORCAHOST Inventory OrcaScore          | data.OrcaScore.value           |
| ORCAHOST Inventory Region             | data.Region.value              |
| ORCAHOST Inventory RiskLevel          | data.RiskLevel.value           |
| ORCAHOST Inventory Score              | data.Score.value               |
| ORCAHOST Inventory State              | data.State.value               |
| ORCAHOST Inventory Status             | data.Status.value              |
| ORCAHOST Inventory SubCategory        | data.SubCategory.value         |
| ORCAHOST Inventory UiUniqueField      | data.UiUniqueField.value       |
| ORCAHOST Inventory CreationTime       | data.CreationTime.value        |
| ORCAHOST Inventory Observations       | data.Observations.value        |
| ORCAHOST Inventory RelatedCompliances | data.RelatedCompliances.value  |
| ORCAHOST Inventory Zones              | data.Zones.value               |
| PluginId                              | data.RuleId.value              |
| Title                                 | data.AlertType.value           |
| First Discovered On                   | data.CreatedAt                 |
| Last Discovered On                    | data.LastSeen                  |
| Scanner Reported Severity             | data.Score.value               |
| Severity                              | data.Score.value               |
| Scanner Unique Id                     | data.id                        |
| ORCAHOST Alert Id                     | data.AlertId.value             |
| ORCAHOST Alert Source                 | data.AlertSource.value         |
| ORCAHOST Category                     | data.Category.value            |
| ORCAHOST                              | data.Category.value            |
| ORCAHOST                              | data.CommentsCount.value       |
| ORCAHOST CVE Exploit Available        | data.CVEExploitAvailable.value |
| ORCAHOST CVE Fix Available            | data.CveFixAvailable           |
| ORCAHOST Hostname                     | data.Hostname                  |
| ORCAHOST Is Live                      | data.IsLive.value              |
| ORCAHOST Max CVSS Score               | data.MaxCvssScore              |
| ORCAHOST Orca Score                   | data.Name.value                |
| ORCAHOST Orca Score                   | data.OrcaScore.value           |
| ORCAHOST Risk Level                   | data.RiskLevel.value           |
| ORCAHOST                              | data.RuleSource.value          |
| ORCAHOST Rule Type                    | data.RuleType.value            |
| ORCAHOST Alert Severity               | data.Severity.value            |
| ORCAHOST Alert Source                 | data.AlertSource.value         |
| ORCAHOST Last Updated                 | data.LastUpdated               |
| ORCAHOST Labels                       | data.Labels.value              |
| ORCAHOST RelatedCompliance            | data.RelatedCompliances.value  |
| ORCAHOST Finding name                 | data.Inventory.data.Name.value |
| ORCAHOST Inventory type               | data.Inventory.data.Type.value |

### Application Mappings

| **RBVM Field**                  | **Mapping Field**              |
| ------------------------------- | ------------------------------ |
| Plugin ID                       | data.AssetUniqueId.value       |
| Application Name                | data.Type.value                |
| ID                              | id                             |
| First Discovered On             | data.FirstSeen                 |
| Last Discovered On              | data.LastSeen                  |
| ORCAAPP Category                | data.Category.value            |
| ORCAAPP ConsoleUrlLink          | data.ConsoleUrlLink.value      |
| ORCAAPP Exposure                | data.Exposure.value            |
| ORCAAPP IsInternetFacing        | data.IsInternetFacing.value    |
| ORCAAPP NewCategory             | data.NewCategory.value         |
| ORCAAPP NewSubCategory          | data.NewSubCategory.value      |
| ORCAAPP OrcaScore               | data.OrcaScore.value           |
| ORCAAPP Region                  | data.Region.value              |
| ORCAAPP RiskLevel               | data.RiskLevel.value           |
| ORCAAPP Score                   | data.Score.value               |
| ORCAAPP State                   | data.State.value               |
| ORCAAPP Status                  | data.Status.value              |
| ORCAAPP SubCategory             | data.SubCategory.value         |
| ORCAAPP Inventory UiUniqueField | data.UiUniqueField.value       |
| ORCAAPP CreationTime            | data.CreationTime.value        |
| ORCAAPP UpdatedTime             | data.UpdatedTime               |
| ORCAAPP Observations            | data.Observations.value        |
| ORCAAPP RelatedCompliances      | data.RelatedCompliances.value  |
| ORCAAPP Zones                   | data.Zones.value               |
| ORCAAPP Compute Regions         | data.Region.value              |
| Plugin ID                       | data.RuleId.value              |
| Title                           | data.AlertType.value           |
| First Discovered On             | data.CreatedAt                 |
| Last Discovered On              | data.LastSeen                  |
| Scanner Reported Severity       | data.Score.value               |
| Severity                        | data.Score.value               |
| Scanner Unique Id               | data.id                        |
| ORCAAPP Alert Id                | data.AlertId.value             |
| ORCAAPP Alert Source            | data.AlertSource.value         |
| ORCAAPP Category                | data.Category.value            |
| ORCAAPP Is Live                 | data.IsLive.value              |
| ORCAAPP Orca Score              | data.OrcaScore.value           |
| ORCAAPP Risk Level              | data.RiskLevel.value           |
| ORCAAPP Risk Source             | data.RuleSource.value          |
| ORCAAPP Rule Type               | data.RuleType.value            |
| ORCAAPP Alert Severity          | data.Severity.value            |
| ORCAAPP Alert Source            | data.AlertSource.value         |
| ORCAAPP Last Updated Time       | data.LastUpdatedTime           |
| ORCAAPP Labels                  | data.Labels.value              |
| ORCAAPP RelatedCompliance       | data.RelatedCompliances.value  |
| ORCAAPP Inventory type          | data.Inventory.data.Type.value |