Orca Security Plugin for Risk Exchange - Netskope Technical Documentation

Release Note

1.0.0 (Requires minimum Cloud Exchange version 6.1.0)
Added

Initial release.
- Entities: Users, Workloads
- Actions: Scan Data Now, Add/Remove Custom Tag

This document explains how to configure the Orca Security v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch Workloads and Users from the Inventory > Inventory Overview page from following ‘Asset Category or Type’ AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account in Orca Security. This plugin supports the ‘Scan Data Now’ action to trigger an on-demand Orca scan and the ‘Add/Remove Custom Tag’ action to add or remove custom tags for Workloads and Users.

Netskope Normalized Score = round((10 – Risk Score) * 100), computed only when Risk Score is present and within [0.0, 10.0].

Prerequisites

To complete this integration, you need:

A Netskope tenant (or multiple, for example, production and development/test instances).
A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
An Orca Security instance.
Connectivity to the following hosts:
- https://app.orcasecurity.io (Global)
- https://app.in.orcasecurity.io (India)
- https://app.eu.orcasecurity.io (Europe)
- https://app.au.orcasecurity.io (Australia)
- https://app.sa.orcasecurity.io (South America)
- https://app.id.orcasecurity.io (Indonesia)
- https://app.gov.orcasecurity.io (Government)

Orca Security Plugin Support

This plugin is used to fetch Workloads and Users from the Inventory > Inventory Overview page from following Asset Category or Type AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account in Orca Security. This plugin supports the Scan Data Now action to trigger an on-demand Orca scan and the Add/Remove Custom Tag action to add or remove custom tags for Workloads and Users.

Netskope Normalized Score = round((10 – Risk Score) * 100), computed only when Risk Score is present and within [0.0, 10.0].

Type of Data Pulled	Actions
Workloads, Users	Scan Data Now Add/Remove Custom Tag No Action

Mappings

Mappings are used to view the pulled records along with their respective details. Mapped fields during plugin configuration will be visible on the Records page once the data is pulled. Here are the suggested mappings that should be used while configuring the plugin.

Pull Mapping for Workloads

Plugin Field Label	Expected Data Type	Suggested Field Label	Aggregate Strategy	Example
Entity Unique ID	String	Orca Entity Unique ID	Unique	a1b2c3d4-e5f6-7890-abcd-ef1234567890
Entity ID	String	Orca Entity ID	Overwrite	orca-id-98765
Hostname	String	Orca Host Name	Overwrite	web-server-01
Asset Name	String	Orca Asset Name	Overwrite	web-server-01
Type	String	Orca Asset Type	Overwrite	AwsEc2Instance
Cloud Provider	String	Orca Cloud Provider	Overwrite	AWS
Category	String	Orca Asset Category	Overwrite	Compute
Risk Level	String	Orca Risk Level	Overwrite	High
Risk Score	Number	Orca Risk Score	Overwrite	6.5
State	String	Orca State	Overwrite	Running
Exposure	String	Orca Exposure	Overwrite	public_facing
Is Internet Facing	Boolean	Orca Is Internet Facing	Overwrite	true
Is Crown Jewel	Boolean	Orca Is Crown Jewel	Overwrite	false
Crown Jewel Score	Number	Orca Crown Jewel Score	Overwrite	8
Crown Jewel Reason	String	Orca Crown Jewel Reason	Overwrite	Contains PII
Public IP	String	Orca Public IP Address	Overwrite	54.23.1.10
Private IP	String	Orca Private IP Address	Overwrite	10.0.0.5
Public DNS	List	Orca Public DNS Name	Overwrite	[“ec2-54-23-1-10.compute.amazonaws.com”]
Private DNS	List	Orca Private DNS Name	Overwrite	[“ip-10-0-0-5.ec2.internal”]
MAC Addresses	List	Orca MAC Address	Overwrite	[“02:1a:2b:3c:4d:5e”]
Region	String	Orca Region	Overwrite	us-east-1
Availability Zones	List	Orca Availability Zone	Overwrite	[“us-east-1a”]
Matched CVEs	List	Orca Matched CVEs	Overwrite	[“CVE-2024-1234”]
Max CVSS Score	Number	Orca Max CVSS Score	Overwrite	9.8
Tags	List	Orca Tags	Overwrite	[“env: production”]
Model Tags	List	Orca Model Tags	Overwrite	[“owner: platform-team”]
Netskope Normalized Score	Number	Orca Netskope Normalized Score	Overwrite	350
Alerts Count	Number	Alerts Count	Overwrite	3
Login Attempts Count	Number	Orca Login Attempts Count	Overwrite	0
Vulnerability Count	Number	Orca Vulnerability Count	Overwrite	12
Ports	List	Orca Open Ports	Overwrite	[443, 8080]
Port Services	List	Orca Port Services	Overwrite	[“https”]
Port Protocols	List	Orca Port Protocols	Overwrite	[“tcp”]
Custom Tags	List	Orca Custom Tags	Overwrite	[“team: security”]

Pull Mapping for Users

Plugin Field Label	Expected Data Type	Suggested Field Label	Aggregate Strategy	Example
Entity Unique ID	String	Orca Unique Identity ID	Unique (Keep this Overwrite if you want to merge records with Netskope Risk Exchange plugin)	b2c3d4e5-f6a7-8901-bcde-f23456789012
Entity ID	String	Orca Identity ID	Overwrite	orca-user-id-54321
Email	String	Email	Overwrite (Keep this unique if you want to merge records with Netskope Risk Exchange plugin)	jane.doe@example.com
Display Name	String	Orca Display Name	Overwrite	Jane Doe
Type	String	Orca Identity Type	Overwrite	AwsUser
Cloud Provider	String	Orca Cloud Provider	Overwrite	AWS
Category	String	Orca Identity Category	Overwrite	Identity
Risk Level	String	Orca Risk Level	Overwrite	Medium
Risk Score	Number	Orca Risk Score	Overwrite	4.2
State	String	Orca State	Overwrite	Active
Tags	List	Orca Tags	Overwrite	[“dept: finance”]
Model Tags	List	Orca Model Tags	Overwrite	[“managed-by: iam-team”]
Netskope Normalized Score	Number	Orca Netskope Normalized Score	Overwrite	580
Custom Tags	List	Orca Custom Tags	Overwrite	[“reviewed: true”]

To merge records between Netskope Tenant and Orca Security , you need to keep one field as unique and common between both the plugins. Example: If you have common users with the same email on Netskope Tenant as well as Orca Security tenant then you can keep the Email field as a common and unique field between the Netskope Risk Exchange plugin and Orca Security plugin to merge the pulled records.

Permissions

API Token must have an Editor role.

API Details

List of APIs Used

API Endpoint	Method	Use Case
/api/serving-layer/query	POST	Pull Workload and User records; fetch open ports data; connectivity check
/api/serving-layer/linked_entities_count	POST	Fetch Alerts, Login Attempts, and Vulnerability counts for Workloads
/api/manual_tags/{asset_id}	GET	Fetch Custom Tags for a Workload or User
/api/manual_tags/{asset_id}	POST	Add a Custom Tag to a Workload or User
/api/manual_tags/{asset_id}	DELETE	Remove a Custom Tag from a Workload or User
/api/scan/asset/{asset_unique_id}	POST	Trigger an on-demand scan for a Workload or User

Query Assets

Endpoint: POST /api/serving-layer/query

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Request Body

{
  "query": {
    "type": "object_set",
    "models": [
      "AwsEc2Instance",
      "AzureComputeVm",
      "AzureContainerInstance",
      "GcpVmInstance",
      "OciComputeVmInstance"
    ]
  },
  "get_results_and_count": true,
  "start_at_index": 0,
  "limit": 100
}

Sample Response

{
    "status": "success",
    "data": [
        {
            "id": "e739eb76-324e-d680-bb39-94ba3aec1bf7",
            "type": "OciComputeVmInstance",
            "data": {
                "AgentConfiguration": {
                    "value": {
                        "areAllPluginsDisabled": false,
                        "isManagementDisabled": false,
                        "isMonitoringDisabled": false,
                        "pluginsConfig": [
                            {
                                "desiredState": "DISABLED",
                                "name": "Vulnerability Scanning"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Oracle Java Management Service"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Oracle Autonomous Linux"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "OS Management Service Agent"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "OS Management Hub Agent"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Management Agent"
                            },
                            {
                                "desiredState": "ENABLED",
                                "name": "Custom Logs Monitoring"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Compute RDMA GPU Monitoring"
                            },
                            {
                                "desiredState": "ENABLED",
                                "name": "Compute Instance Run Command"
                            },
                            {
                                "desiredState": "ENABLED",
                                "name": "Compute Instance Monitoring"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Compute HPC RDMA Auto-Configuration"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Compute HPC RDMA Authentication"
                            },
                            {
                                "desiredState": "ENABLED",
                                "name": "Cloud Guard Workload Protection"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Block Volume Management"
                            },
                            {
                                "desiredState": "DISABLED",
                                "name": "Bastion"
                            }
                        ]
                    }
                },
                "AutoUpdatesStatus": {
                    "value": "on"
                },
                "AvailabilityConfiguration": {
                    "value": {
                        "isLiveMigrationPreferred": null,
                        "recoveryAction": "RESTORE_INSTANCE"
                    }
                },
                "AvailabilityDomain": {
                    "value": "Lhkx:US-ASHBURN-AD-2"
                },
                "AvailabilityZones": {
                    "value": [
                        "Lhkx:US-ASHBURN-AD-2"
                    ]
                },
                "CVECount": {
                    "value": {
                        "In-2017": 1,
                        "In-2024": 450,
                        "In-2025": 1848,
                        "In-2026": 1794,
                        "LastYear": 1848,
                        "TwoYearsAgo": 450
                    }
                },
                "Category": {
                    "value": "VM"
                },
                "ConsoleUrlLink": {
                    "value": "https://cloud.oracle.com/compute/instances/ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq?region=us-ashburn-1"
                },
                "CpuFamily": {
                    "value": "AMD"
                },
                "CreationTime": {
                    "value": "2024-09-19T22:40:35+00:00"
                },
                "DetectedCrownJewelReason": {
                    "value": "Sensitive Data"
                },
                "DetectedCrownJewelScore": {
                    "value": 75
                },
                "DisksInfo": {
                    "value": [
                        "{'size_bytes': 50010783744, 'size': '46.58 GB', 'used_bytes': 6843484160, 'used': '6.37 GB', 'volume_id': 'ocid1.bootvolume.oc1.iad.abuwcljspo2bszfbfhmxpif22vr7lumcdffcxnp4xhpwjl6juyv3foy7duiq'}"
                    ]
                },
                "DistributionInfoSite": {
                    "value": "https://ubuntu.com/"
                },
                "DistributionMajorVersion": {
                    "value": "24"
                },
                "DistributionName": {
                    "value": "Ubuntu"
                },
                "DistributionVersion": {
                    "value": "24.04"
                },
                "DistroCategory": {
                    "value": "debian"
                },
                "EnableSecureBoot": {
                    "value": false
                },
                "EsmStatus": {
                    "value": "disabled"
                },
                "Exposure": {
                    "value": "public_facing"
                },
                "FaultDomain": {
                    "value": "FAULT-DOMAIN-2"
                },
                "FirstSeen": {
                    "value": "2026-02-04T12:48:17+00:00"
                },
                "HasMalwareWithHighConfidence": {
                    "value": false
                },
                "HasSensitiveKeys": {
                    "value": false
                },
                "Hostname": {
                    "value": "shw-helper-ubuntu"
                },
                "ImageId": {
                    "value": "ocid1.image.oc1.iad.aaaaaaaa5by4latw3wcb7ekg4xyj2v6k2bnuebtrw5iiqmy6igxqzox45byq"
                },
                "IngressPorts": {
                    "value": [
                        "0-65535"
                    ]
                },
                "InstanceId": {
                    "value": "ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
                },
                "InstanceShape": {
                    "value": "VM.Standard.E5.Flex"
                },
                "InstanceType": {
                    "value": "VM.Standard.E5.Flex"
                },
                "IsCrownJewel": {
                    "value": true
                },
                "IsIMDSV2Required": {
                    "value": false
                },
                "IsInternetFacing": {
                    "value": true
                },
                "KernelVersion": {
                    "value": "6.8.0-1022-oracle"
                },
                "LastSeen": {
                    "value": "2026-08-19T03:06:26+00:00"
                },
                "LastUpdateTime": {
                    "value": "2026-01-07T06:12:16+00:00"
                },
                "LaunchMode": {
                    "value": "PARAVIRTUALIZED"
                },
                "LaunchOptions": {
                    "value": {
                        "bootVolumeType": "PARAVIRTUALIZED",
                        "firmware": "UEFI_64",
                        "isConsistentVolumeNamingEnabled": true,
                        "isEncryptionInTransitEnabled": null,
                        "isPvEncryptionInTransitEnabled": false,
                        "networkType": "PARAVIRTUALIZED",
                        "remoteDataVolumeType": "PARAVIRTUALIZED"
                    }
                },
                "MacAddresses": {
                    "value": []
                },
                "MatchedCVEs": {
                    "value": 4093
                },
                "MaxCVSSScore": {
                    "value": 10.0
                },
                "ModelTags": {
                    "value": {
                        "Category": "Compute"
                    }
                },
                "Name": {
                    "value": "shw-helper-ubuntu-24"
                },
                "NewCategory": {
                    "value": "Compute Services"
                },
                "NewSubCategory": {
                    "value": "Virtual Instances"
                },
                "NumberOfContainers": {
                    "value": 1
                },
                "Observations": {
                    "value": [
                        "public_facing",
                        "sensitive_data"
                    ]
                },
                "OciState": {
                    "value": "STOPPED"
                },
                "OrcaScore": {
                    "value": 10.0
                },
                "OrcaTags": {
                    "value": {}
                },
                "OsEndOfSupport": {
                    "value": "2029-04-30T00:00:00+00:00"
                },
                "OsSupportInfoSite": {
                    "value": "https://wiki.ubuntu.com/Releases"
                },
                "PiiTypes": {
                    "value": []
                },
                "PrivateDnss": {
                    "value": []
                },
                "PrivateIps": {
                    "value": [
                        "10.88.0.168"
                    ]
                },
                "PublicDnss": {
                    "value": []
                },
                "PublicIps": {
                    "value": [
                        "150.136.78.78"
                    ]
                },
                "Region": {
                    "value": "us-ashburn"
                },
                "Regions": {
                    "value": [
                        "us-ashburn"
                    ]
                },
                "RegionsNames": {
                    "value": []
                },
                "RelatedCompliances": {
                    "value": [
                        "HITRUST Level 1 v11.0.0",
                        "ISO 27001 2022",
                        "US MARS-E Volume 1 2.2.0",
                        "NZISM (New Zealand Information Security Manual)",
                        "EU NIS (Network and Information Security) v2",
                        "US ARC-AMPE Volume 2",
                        "CIS Ubuntu Linux 24.04 Benchmark",
                        "Indian DPDPA (Digital Personal Data Protection Act)",
                        "NIST 800-171 (Rev 2)",
                        "US CMMC (Cybersecurity Maturity Model Certification) Level 2",
                        "HITRUST Level 2 v11.0.0",
                        "US GLBA (Gramm-Leach-Bliley Act) Standards For Safeguarding Customer Information",
                        "India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) 1.0.1 (Aug 2024)",
                        "Indonesian PDPL (Personal Data Protection Law)",
                        "NIST 800-172",
                        "CIS Oracle Cloud Infrastructure Foundations Benchmark 2.0.0",
                        "AU Essential 8 Maturity Level 1 November 2022",
                        "CIS Controls v8.1.2",
                        "UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 4.0.0",
                        "CSA CCM Lite v4.0.13",
                        "MITRE ATT&CK v13",
                        "test",
                        "Orca Identity & Access Best Practices",
                        "Privacy Shield",
                        "Hong Kong PDPO (Personal Data Privacy Ordinance)",
                        "HITRUST Level 3 v9.6.0",
                        "ISO 27018 2019",
                        "CIS Oracle Cloud Infrastructure Foundations Benchmark 3.0.0",
                        "MPA (Motion Picture Association) 5.3.0",
                        "Multi-Level Protection Scheme 2.0 (Level 3)",
                        "NIST 800-53 (Rev 5.1.1)",
                        "CIS Docker Benchmark 1.3.1",
                        "US FERPA (Family Educational Rights and Privacy Act)",
                        "US CJIS (Criminal Justice Information Services) 5.8.0",
                        "Spain National Security Scheme",
                        "FedRAMP",
                        "ISO 27701",
                        "CMORG Cloud Control Framework",
                        "US COPPA (Children’s Online Privacy Protection)",
                        "OWASP NHI Top Ten",
                        "CSA CCM v4.0.5",
                        "Singapore PDPA (Personal Data Protection Act)",
                        "Canada PIPEDA (Personal Information Protection and Electronic Documents Act)",
                        "AU Essential 8 Maturity Level 3 November 2022",
                        "AU Essential 8 Maturity Level 2 November 2022",
                        "NYDFS (New York Department of Financial Services)",
                        "SOC 2",
                        "Japan FISC Security Guidelines on Computer Systems for Financial Institutions 11th Edition",
                        "RBI (Reserve Bank of India)",
                        "Telecommunications Security Code of Practice",
                        "MPA (Motion Picture Association) 5.0.0",
                        "South Korea ISMS-P (Personal information & Information Security Management System)",
                        "PCI DSS 3.2.1",
                        "EU DORA (Digital Operational Resilience Act)",
                        "HITRUST Level 3 v11.0.0",
                        "ISM (Australian Government Information Security Manual) September 2022",
                        "DSPM (Data Security Posture Management) Best Practices",
                        "HIPAA",
                        "MASTRM (Monetary Authority of Singapore Technology Risk Management)",
                        "China PIPL (Personal Information Protection Law)",
                        "CPRA (California Privacy Rights Act)",
                        "ISM (Australian Government Information Security Manual) March 2024",
                        "US FFIEC (Federal Financial Institutions Examination Council)",
                        "ISO 27002 2022",
                        "LGPD (Brazilian General Data Protection)",
                        "ISM (Australian Government Information Security Manual) March 2026",
                        "CIS Controls v8",
                        "APRA CPS 234 Information Security",
                        "PCI DSS 4.0.0",
                        "NIST 800-190",
                        "Indian DPDPA (Digital Personal Data Protection Act) 2025",
                        "Orca Best Practices 2.0.0",
                        "AU Essential 8 Maturity Level 2 November 2023",
                        "SOX 404",
                        "Japan FISC Security Guidelines on Computer Systems for Financial Institutions 13th Edition",
                        "NERC CIP (Critical Infrastructure Protection)",
                        "UK Cyber Essentials",
                        "GDPR",
                        "Swift CSCF (Customer Security Controls Framework)",
                        "AU Essential 8 Maturity Level 1 November 2023",
                        "PCI DSS 4.0.1",
                        "NIST 800-53 (Rev 5)",
                        "ISO 27017",
                        "CCPA",
                        "US CJIS (Criminal Justice Information Services) 6.0.0",
                        "NIST 800-53 (Rev 4)",
                        "CIS Oracle Cloud Infrastructure Foundations Benchmark 1.2.0",
                        "India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework)",
                        "AU Essential 8 Maturity Level 3 November 2023",
                        "NIST CSF 2.0.0",
                        "MITRE ATT&CK v12",
                        "ISO 27001 2013",
                        "Germany TISAX VDA",
                        "Orca for Post Quantum Cryptography",
                        "NIST 800-171 (Rev 3)",
                        "UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 3.1.0"
                    ]
                },
                "RiskLevel": {
                    "value": "critical"
                },
                "Score": {
                    "value": 3
                },
                "SourceType": {
                    "value": "image"
                },
                "State": {
                    "value": "stopped"
                },
                "StopDate": {
                    "value": "2026-02-04T12:48:13+00:00"
                },
                "SubCategory": {
                    "value": "VM"
                },
                "Tags": {
                    "value": {
                        "Lifetime": "Long Term",
                        "Oracle-Tags-CreatedBy": "oktasso_qualys_oraclecengg1/saher@qualys.com",
                        "Oracle-Tags-CreatedOn": "'2024-09-19T22:40:34.067Z'",
                        "Owner": "Shweta Aher"
                    }
                },
                "TotalDisksBytes": {
                    "value": 50010783744
                },
                "TotalVulnerabilitiesFound": {
                    "value": 6419
                },
                "Type": {
                    "value": "OciComputeVmInstance"
                },
                "UiUniqueField": {
                    "value": "ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
                },
                "UpdatedTime": {
                    "value": "2026-01-07T06:12:16+00:00"
                },
                "Zones": {
                    "value": [
                        "Lhkx:US-ASHBURN-AD-2"
                    ]
                },
                "AssetUniqueId": {
                    "value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
                },
                "bu_tags": {
                    "value": ",-32325982428363234,"
                },
                "cluster_unique_id": {
                    "value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
                },
                "full_scan_time": {
                    "value": "2026-08-19T01:38:59+00:00"
                },
                "GroupUniqueId": {
                    "value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
                }
            },
            "name": "shw-helper-ubuntu-24",
            "group_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
            "cluster_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
            "asset_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
            "last_seen": "2026-08-19T03:50:49+00:00"
        }
],
    "total_items": 1142
}

Query Users

Endpoint: POST /api/serving-layer/query

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Request Body

{
  "query": {
    "type": "object_set",
    "models": [
      "GcpUser",
      "AwsUser",
      "OciUser",
      "AzureUser",
      "AzureServicePrincipal",
      "GcpIamServiceAccount",
      "K8sServiceAccount"
    ]
  },
  "get_results_and_count": true,
  "start_at_index": 0,
  "limit": 100
}

Sample Response

{
    "status": "success",
    "data": [
        {
            "id": "e739eb76-3b38-9580-8805-1c9b10b4b088",
            "type": "AzureServicePrincipal",
            "data": {
                "AppId": {
                    "value": "076af1ed-de03-4981-9ed2-066f89d2aafe"
                },
                "AppOwnerOrganizationId": {
                    "value": "ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb"
                },
                "AzureId": {
                    "value": "ef893edf-6aab-494b-b037-935e7a237cb5"
                },
                "Category": {
                    "value": "Users and Access"
                },
                "CreationTime": {
                    "value": "2024-02-27T05:44:00+00:00"
                },
                "Exposure": {
                    "value": "N/A"
                },
                "FirstSeen": {
                    "value": "2026-01-20T05:05:57+00:00"
                },
                "IdentityId": {
                    "value": "ef893edf-6aab-494b-b037-935e7a237cb5"
                },
                "IsCrownJewel": {
                    "value": false
                },
                "IsEnabled": {
                    "value": true
                },
                "IsInternal": {
                    "value": true
                },
                "IsTrusted": {
                    "value": true
                },
                "LastSeen": {
                    "value": "2026-08-19T22:32:09+00:00"
                },
                "Name": {
                    "value": "aro-app-1709012625479"
                },
                "NewCategory": {
                    "value": "Identity and Access"
                },
                "NewSubCategory": {
                    "value": "Cloud Non-Human Identities (NHI)"
                },
                "Observations": {
                    "value": []
                },
                "OrcaScore": {
                    "value": 1.0
                },
                "PrincipalId": {
                    "value": "ef893edf-6aab-494b-b037-935e7a237cb5"
                },
                "RelatedCompliances": {
                    "value": [
                        "APRA CPS 234 Information Security",
                        "AU Essential 8 Maturity Level 1 November 2023",
                        "AU Essential 8 Maturity Level 2 November 2023",
                        "AU Essential 8 Maturity Level 3 November 2022",
                        "AU Essential 8 Maturity Level 3 November 2023",
                        "Azure Well-Architected",
                        "CCPA",
                        "CIS Azure Kubernetes Service (AKS) Benchmark 1.7.0",
                        "CIS Controls v8",
                        "CIS Controls v8.1.2",
                        "CIS Microsoft Azure Foundations Benchmark 5.0.0",
                        "CIS Microsoft Azure Foundations Benchmark 6.0.0",
                        "CMORG Cloud Control Framework",
                        "CPRA (California Privacy Rights Act)",
                        "CSA CCM Lite v4.0.13",
                        "CSA CCM v4.0.5",
                        "Canada PIPEDA (Personal Information Protection and Electronic Documents Act)",
                        "China PIPL (Personal Information Protection Law)",
                        "DSPM (Data Security Posture Management) Best Practices",
                        "EU DORA (Digital Operational Resilience Act)",
                        "EU NIS (Network and Information Security) v2",
                        "FedRAMP",
                        "GDPR",
                        "Germany TISAX VDA",
                        "HIPAA",
                        "HITRUST Level 1 v11.0.0",
                        "HITRUST Level 2 v11.0.0",
                        "HITRUST Level 3 v11.0.0",
                        "HITRUST Level 3 v9.6.0",
                        "Hong Kong PDPO (Personal Data Privacy Ordinance)",
                        "ISM (Australian Government Information Security Manual) March 2024",
                        "ISM (Australian Government Information Security Manual) March 2026",
                        "ISM (Australian Government Information Security Manual) September 2022",
                        "ISO 27001 2013",
                        "ISO 27001 2022",
                        "ISO 27002 2022",
                        "ISO 27017",
                        "ISO 27018 2019",
                        "India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework)",
                        "India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) 1.0.1 (Aug 2024)",
                        "Indian DPDPA (Digital Personal Data Protection Act)",
                        "Indian DPDPA (Digital Personal Data Protection Act) 2025",
                        "Indonesian PDPL (Personal Data Protection Law)",
                        "Japan FISC Security Guidelines on Computer Systems for Financial Institutions 11th Edition",
                        "Japan FISC Security Guidelines on Computer Systems for Financial Institutions 13th Edition",
                        "LGPD (Brazilian General Data Protection)",
                        "MASTRM (Monetary Authority of Singapore Technology Risk Management)",
                        "MCSB (Microsoft Cloud Security Benchmark)",
                        "MITRE ATT&CK v12",
                        "MITRE ATT&CK v13",
                        "MPA (Motion Picture Association) 5.3.0",
                        "Multi-Level Protection Scheme 2.0 (Level 3)",
                        "NERC CIP (Critical Infrastructure Protection)",
                        "NIST 800-171 (Rev 2)",
                        "NIST 800-171 (Rev 3)",
                        "NIST 800-172",
                        "NIST 800-53 (Rev 4)",
                        "NIST 800-53 (Rev 5)",
                        "NIST 800-53 (Rev 5.1.1)",
                        "NIST CSF",
                        "NIST CSF 2.0.0",
                        "NYDFS (New York Department of Financial Services)",
                        "NZISM (New Zealand Information Security Manual)",
                        "OWASP NHI Top Ten",
                        "Orca Best Practices",
                        "Orca Best Practices 2.0.0",
                        "Orca Identity & Access Best Practices",
                        "Orca for Post Quantum Cryptography",
                        "PCI DSS 3.2.1",
                        "PCI DSS 4.0.0",
                        "PCI DSS 4.0.1",
                        "Privacy Shield",
                        "RBI (Reserve Bank of India)",
                        "SOC 2",
                        "SOX 404",
                        "Singapore PDPA (Personal Data Protection Act)",
                        "South Korea ISMS-P (Personal information & Information Security Management System)",
                        "Spain National Security Scheme",
                        "Swift CSCF (Customer Security Controls Framework)",
                        "Telecommunications Security Code of Practice",
                        "UK Cyber Essentials",
                        "UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 3.1.0",
                        "UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 4.0.0",
                        "US ARC-AMPE Volume 2",
                        "US CJIS (Criminal Justice Information Services) 5.8.0",
                        "US CJIS (Criminal Justice Information Services) 6.0.0",
                        "US CMMC (Cybersecurity Maturity Model Certification) Level 2",
                        "US COPPA (Children’s Online Privacy Protection)",
                        "US FERPA (Family Educational Rights and Privacy Act)",
                        "US FFIEC (Federal Financial Institutions Examination Council)",
                        "US GLBA (Gramm-Leach-Bliley Act) Standards For Safeguarding Customer Information",
                        "US MARS-E Volume 1 2.2.0",
                        "test"
                    ]
                },
                "RiskLevel": {
                    "value": "informational"
                },
                "Score": {
                    "value": 4
                },
                "ServicePrincipalNames": {
                    "value": [
                        "076af1ed-de03-4981-9ed2-066f89d2aafe"
                    ]
                },
                "ServicePrincipalType": {
                    "value": "Application"
                },
                "SubCategory": {
                    "value": "ManagedIdentities"
                },
                "Type": {
                    "value": "AzureServicePrincipal"
                },
                "UiUniqueField": {
                    "value": "ef893edf-6aab-494b-b037-935e7a237cb5"
                },
                "Zones": {
                    "value": []
                },
                "AssetUniqueId": {
                    "value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
                },
                "bu_tags": {
                    "value": ",-32325982428363234,-1894962669124995387,2112785123256613438,-4124477540523243805,-7644646143476473755,-7911719698443582879,-3252461980860312900,"
                },
                "cluster_unique_id": {
                    "value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
                },
                "full_scan_time": {
                    "value": "2026-08-19T22:32:03+00:00"
                },
                "GroupUniqueId": {
                    "value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
                }
            },
            "name": "aro-app-1709012625479",
            "group_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
            "cluster_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
            "asset_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
            "last_seen": "2026-08-19T22:34:47+00:00"
        }
],
    "total_items": 6643
}

Fetch Linked Entity Counts

Endpoint: POST /api/serving-layer/linked_entities_count

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Request Body

{
  "model": "OciComputeVmInstance",
  "base_id": "{{asset_id}}"
}

Sample Response

{
    "status": "success",
    "data": {
        "asset_id": "e739eb76-324e-d680-bb39-94ba3aec1bf7",
        "links": [
            {
                "related_model": "AttackPathInventories",
                "relation_key": "AttackPathInventories",
                "reversed_relation_key": "Inventory",
                "count": 2
            },
            {
                "related_model": "Application",
                "relation_key": "Applications",
                "reversed_relation_key": "Compute",
                "count": 5
            },
            {
                "related_model": "Container",
                "relation_key": "Containers",
                "reversed_relation_key": "Vm",
                "count": 1
            },
            {
                "related_model": "Subnet",
                "relation_key": "SubnetList",
                "reversed_relation_key": "ComputeObjects",
                "count": 1
            },
            {
                "related_model": "InventoryCustomTags",
                "relation_key": "CustomTags",
                "reversed_relation_key": "inventory",
                "count": 1
            },
            {
                "related_model": "OciIdentityCompartment",
                "relation_key": "Compartment",
                "reversed_relation_key": "VmInstances",
                "count": 1
            },
            {
                "related_model": "OciVnic",
                "relation_key": "OciVnics",
                "reversed_relation_key": "Vm",
                "count": 1
            },
            {
                "related_model": "Alert",
                "relation_key": "InventoryAlerts",
                "reversed_relation_key": "Inventory",
                "count": 263
            },
            {
                "related_model": "Alert",
                "relation_key": "Alerts",
                "reversed_relation_key": "Inventories",
                "count": 263
            },
            {
                "related_model": "AssetScanStatus",
                "relation_key": "AssetScanStatus",
                "reversed_relation_key": "Inventory",
                "count": 1
            },
            {
                "related_model": "AssetSshKeyPair",
                "relation_key": "AssetSshKeyPairs",
                "reversed_relation_key": "Content",
                "count": 4
            },
            {
                "related_model": "ConfigurationFile",
                "relation_key": "ConfigurationFiles",
                "reversed_relation_key": "Content",
                "count": 4
            },
            {
                "related_model": "InstalledPackage",
                "relation_key": "InstalledPackages",
                "reversed_relation_key": "Content",
                "count": 992
            },
            {
                "related_model": "LocalPort",
                "relation_key": "LocalPorts",
                "reversed_relation_key": "Compute",
                "count": 4
            },
            {
                "related_model": "LoginAttempt",
                "relation_key": "LoginAttempts",
                "reversed_relation_key": "Compute",
                "count": 38
            },
            {
                "related_model": "OrcaScanStatus",
                "relation_key": "OrcaLastScanStatus",
                "reversed_relation_key": "Inventory",
                "count": 1
            },
            {
                "related_model": "PIIDirectory",
                "relation_key": "PIIDirectories",
                "reversed_relation_key": "Content",
                "count": 7
            },
            {
                "related_model": "Role",
                "relation_key": "Roles",
                "reversed_relation_key": "Compute",
                "count": 1
            },
            {
                "related_model": "RunningService",
                "relation_key": "RunningServices",
                "reversed_relation_key": "Compute",
                "count": 42
            },
            {
                "related_model": "ScanEngineData",
                "relation_key": "ScanEngineData",
                "reversed_relation_key": "Content",
                "count": 1
            },
            {
                "related_model": "SensitiveData",
                "relation_key": "SensitiveData",
                "reversed_relation_key": "Inventory",
                "count": 16
            },
            {
                "related_model": "SensitiveFile",
                "relation_key": "SensitiveFiles",
                "reversed_relation_key": "Content",
                "count": 12
            },
            {
                "related_model": "ShellHistoryFile",
                "relation_key": "ShellHistoryFiles",
                "reversed_relation_key": "Content",
                "count": 2
            },
            {
                "related_model": "ShellHistorySuspiciousCommand",
                "relation_key": "ShellHistorySuspiciousCommands",
                "reversed_relation_key": "Content",
                "count": 1
            },
            {
                "related_model": "SshAuthorizedKey",
                "relation_key": "SshAuthorizedKeys",
                "reversed_relation_key": "Content",
                "count": 2
            },
            {
                "related_model": "SshAuthorizedKeyFile",
                "relation_key": "SshAuthorizedKeyFiles",
                "reversed_relation_key": "Content",
                "count": 3
            },
            {
                "related_model": "SSHConfigurationFile",
                "relation_key": "SSHConfigurationFiles",
                "reversed_relation_key": "Content",
                "count": 1
            },
            {
                "related_model": "SshKey",
                "relation_key": "SshKeys",
                "reversed_relation_key": "Content",
                "count": 6
            },
            {
                "related_model": "VulnerabilityV2",
                "relation_key": "VulnerabilityV2s",
                "reversed_relation_key": "Inventory",
                "count": 7105
            },
            {
                "related_model": "CloudAccount",
                "relation_key": "CloudAccount",
                "reversed_relation_key": "vm",
                "count": 1
            },
            {
                "related_model": "CloudAccount",
                "relation_key": "CloudAccount",
                "reversed_relation_key": "compute",
                "count": 1
            },
            {
                "related_model": "CloudAccount",
                "relation_key": "CloudAccount",
                "reversed_relation_key": "content",
                "count": 1
            },
            {
                "related_model": "CloudAccount",
                "relation_key": "CloudAccount",
                "reversed_relation_key": "inventory",
                "count": 1
            },
            {
                "related_model": "CloudAccount",
                "relation_key": "CloudAccount",
                "reversed_relation_key": "ocicomputevminstance",
                "count": 1
            }
        ],
        "from_cache": false
    }
}

Fetch Custom Tags

Endpoint: GET /api/manual_tags/{asset_id}

Request Headers

Key	Value
Authorization	Token {api_token}

Sample Response

{
  "status": "success",
  "data": {
    "netskope-ce": "managed",
    "cost-center": "CC-4471",
    "owner": "platform-team"
  }
}

Add Custom Tag

Endpoint: POST /api/manual_tags/{asset_id}

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Request Body

{
  "tag_key": "netskope-ce",
  "tag_value": "quarantine"
}

Sample Response

{
  "status": "success",
  "data": {
    "asset_id": "b1f4c3d2-8a6e-4f19-9c07-2d5e7a1b8f43",
    "tag_key": "netskope-ce",
    "tag_value": "quarantine"
  }
}

Remove Custom Tag

Endpoint: DELETE /api/manual_tags/{asset_id}

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Sample Request

{
  "tag_key": "netskope-ce"
}

Sample Request

{
  "status": "success",
  "data": {
    "asset_id": "b1f4c3d2-8a6e-4f19-9c07-2d5e7a1b8f43",
    "tag_key": "netskope-ce"
  }
}

Scan Data Now

Endpoint: POST /api/scan/asset/{asset_unique_id}

Request Headers

Key	Value
Authorization	Token {api_token}
Content-Type	application/json

Sample Response

{
    "scan_unique_id": "req_73521d3c-d567-4f71-aeb8-ee19e12811ee",
    "asset_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
}

Performance Matrix

Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k Workloads and Users.

Description	Specification
Stack details	Size: Large RAM: 32 GB CPU: 16 Cores
Workloads fetched and updated from Orca Security	~95 minutes
Users fetched and updated from Orca Security	~95 minutes

User Agent

netskope-ce-6.1.0-cre-orca-security-v1.0.0

Workflow

Get your Orca Security API Token.
Configure the Orca Security plugin.
Configure a Risk Exchange Business Rule.
Configure Risk Exchange Actions.
Validation

Watch a Video

Click play to watch a video:

Get your Orca Security API Token

Log in to your Orca Security instance. Go to Settings > API Token and click Add API Token.
Enter a Name, Description, and Expiration as per your needs, and then click Add.
Copy the generated token.

Configure the Orca Security Plugin

In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Orca Security v1.0.0 plugin.
Enter a plugin configuration name and change sync interval if needed.
Click Next and enter the Configuration Parameters:
- Base URL: Select the region of your Orca Security tenant. Select Custom to reveal a Custom Base URL field for tenants that use a different base URL.
- Custom Base URL: Only shown when Base URL is Custom; mandatory whenever shown. Full custom base URL for the Orca Security tenant, must include a URL scheme and network location.
- API Token: API Token for authenticating with the Orca platform you obtained earlier.
- Workload Types: Select Workload Types to pull the Workloads entity records. Leave empty to pull all Workloads entity records.
- User Types: Select User Types to pull the Users entity records. Leave empty to pull all Users entity records.
- Fetch Additional Workload Details: Select which additional Workload details to fetch during the update cycle. When Additional Workload Count Details is selected, an additional API call to /serving-layer/linked_entities_count is made once per Workload to fetch Alerts Count, Login Attempts Count, and Vulnerability Count. When Additional Workload Ports Details is selected, an additional API call to /serving-layer/query is made for public-facing workloads to fetch Ports, Port Services, and Port Protocols.
- Fetch Custom Tags: When set to Yes, an additional API call to /manual_tags/{asset_id} is made once per asset to fetch Custom Tags on both Workloads and Users.
Click Next and select the required Entity from the Entity dropdown. Provide the field mapping per your needs. You can create a new Entity by clicking Add New Entity.

To create a new field, click Add field.

Provide the Field Label, Data Type, Normalization, and Aggregate Strategy per your needs, and then click Save.

Map the created fields:

Similarly, here are the mapped fields for Users Entity:

Refer to the Mappings section before configuring the plugin.
Click Save.

Add a Risk Exchange Business Rule for the Orca Security Plugin

Go to Risk Exchange > Business Rules and click Create New Rule.
Enter a Rule Name. Select the Entity for the Fields that were configured for the Orca Security plugin, and configure the query based on your requirements. This example filters the data fetched from the plugin.
Click Save.

Add Risk Exchange Actions for the Orca Security Plugin

The Orca Security pluginvsupports the following action types:

Add/Remove Custom Tag: This action can be used to add or remove tags from supported Workloads and Users pulled from Orca Security Instance.
Scan Data Now: This action can be used to trigger Scan Data Now action on the supported Workloads and Users pulled from the Orca Security Instance.
No Action: No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

You can perform multiple actions on the pulled records from Orca Security on the Netskope Tenant, for performing the related actions on Netskope refer to the Netskope Risk Exchange plugin guide.

Add/Remove Custom Tag

Go to Risk Exchange > Actions and click Add Action Configuration.
Select the required Business Rule, Configuration, and Action from their respective dropdowns, and then enter these Action parameters:
- Tag Action: Whether to add or remove the tag on the asset. Select Static for the Tag Action from the dropdown.
- Tag Key: Key of the custom tag to add/remove. Select Static for the Tag Value from the dropdown. Note that multiple values are not allowed in this field.
- Tag Value: Value of the custom tag. Required when Tag Action is Add only. Select static field only. Note that multiple values are not allowed in this field.
- Entity ID: The Orca id of the asset to tag/untag. Select the Entity ID source field to resolve it automatically from each Business Rule matched record, or enter one fixed static value to tag/untag a single specific asset regardless of which records matched. Note that multiple values are not allowed in this field.
Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
Click Save.

Scan Data Now

Go to Risk Exchange > Actions and click Add Action Configuration.
Select the required Business Rule, Configuration, and Action from their respective dropdown and then fill the following action parameters:
Asset Unique ID: The Orca ‘asset_unique_id’ of the asset to scan. Select the Entity Unique ID for the Source field to resolve it automatically from each Business Rule matched record, or enter one fixed value to scan a single specific asset regardless of which records matched. Note that multiple values are not allowed in this field.
Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
Click Save.

No Action

Go to Risk Exchange > Actions and click Add Action Configuration.
Select the required Business Rule, Configuration, and Action from their respective dropdown.
Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
Click Save.

Validate the Orca Security Plugin

Validate in Cloud Exchange

Go to Risk Exchange and click Records. Select the Entity that was selected while configuring the field mapping to view the pulled records.

To verify the logs related to pulled records, go to the Settings > Logging and apply the filter with plugin name or plugin configuration name.

Action Validation

Logs for performed Add/Remove Custom Tag action:

Logs for performed Scan Data Now action:

Logs for performed No action:

When a pulled record matches one of the configured business rules, the configured action will be performed on the record. This can be seen in the Cloud Risk Exchange > Action Logs.

Validate in Orca Security

To view the available Assets(Users and Workloads) on Orca Security, log in to your Orca Security instance.

Go to the Inventory > Inventory Overview. This is the page from where the records will be pulled to the Cloud Exchange.

This plugin only supports pulling the Asset Category or Type: AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account

Apply the filter with Asset Category to view the users. For example:

Click on any of the assets to view its details.

Similarly, you can filter the Workloads related category like below:

Click on any of the assets to open its details.

Action Validation

For Add/Remove Custom Tag, filter the particular asset and open its detailed view.

For Scan Data Now, you can check the notification on the Orca Security Instance

To check the Scan status open the detailed view for the particular asset.

Troubleshooting the Orca Security Plugin

Unable to configure the Orca Security plugin

If the plugin fails to save with an error, it could be due to one of the following reasons:

The Base URL is incorrect or not reachable from the CE instance.
The API Token is invalid or has expired or does not have sufficient permissions.

What to do: To solve the above-mentioned issue, follow the points mentioned below.

Verify that the Base URL is the correct Orca Security instance URL
Verify if the API Token is not expired and it has all necessary permissions. Refer to the Configur a tion on the Orca Security platform section.

Unable to pull records from the Orca Security plugin

If you are unable to pull asset records, it may be because the records are not available on Orca Security platform.

What to do: Verify whether the records are present on the Orca Security platform under the Workload Types and User Types used in the plugin configuration. Refer to the Validate in Orca Security section.

Known Behaviors

Orca Security API gives 200 status code for Asset Unique ID’s that are not found on the orca instance, thus the action logs will show Success in Cloud Exchange.
The Orca Security UI sometimes shows multiple records for one Asset Unique ID.