Release Note
1.0.0 (Requires minimum Cloud Exchange version 6.1.0)
Added
- Initial release.
- Entities: Users, Workloads
- Actions: Scan Data Now, Add/Remove Custom Tag
This document explains how to configure the Orca Security v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch Workloads and Users from the Inventory > Inventory Overview page from following ‘Asset Category or Type’ AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account in Orca Security. This plugin supports the ‘Scan Data Now’ action to trigger an on-demand Orca scan and the ‘Add/Remove Custom Tag’ action to add or remove custom tags for Workloads and Users.
Netskope Normalized Score = round((10 – Risk Score) * 100), computed only when Risk Score is present and within [0.0, 10.0].
Prerequisites
To complete this integration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
- An Orca Security instance.
- Connectivity to the following hosts:
- https://app.orcasecurity.io (Global)
- https://app.in.orcasecurity.io (India)
- https://app.eu.orcasecurity.io (Europe)
- https://app.au.orcasecurity.io (Australia)
- https://app.sa.orcasecurity.io (South America)
- https://app.id.orcasecurity.io (Indonesia)
- https://app.gov.orcasecurity.io (Government)
Orca Security Plugin Support
This plugin is used to fetch Workloads and Users from the Inventory > Inventory Overview page from following Asset Category or Type AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account in Orca Security. This plugin supports the Scan Data Now action to trigger an on-demand Orca scan and the Add/Remove Custom Tag action to add or remove custom tags for Workloads and Users.
Netskope Normalized Score = round((10 – Risk Score) * 100), computed only when Risk Score is present and within [0.0, 10.0].
| Type of Data Pulled | Actions |
|---|---|
| Workloads, Users | Scan Data Now Add/Remove Custom Tag No Action |
Mappings
Mappings are used to view the pulled records along with their respective details. Mapped fields during plugin configuration will be visible on the Records page once the data is pulled. Here are the suggested mappings that should be used while configuring the plugin.
Pull Mapping for Workloads
| Plugin Field Label | Expected Data Type | Suggested Field Label | Aggregate Strategy | Example |
|---|---|---|---|---|
| Entity Unique ID | String | Orca Entity Unique ID | Unique | a1b2c3d4-e5f6-7890-abcd-ef1234567890 |
| Entity ID | String | Orca Entity ID | Overwrite | orca-id-98765 |
| Hostname | String | Orca Host Name | Overwrite | web-server-01 |
| Asset Name | String | Orca Asset Name | Overwrite | web-server-01 |
| Type | String | Orca Asset Type | Overwrite | AwsEc2Instance |
| Cloud Provider | String | Orca Cloud Provider | Overwrite | AWS |
| Category | String | Orca Asset Category | Overwrite | Compute |
| Risk Level | String | Orca Risk Level | Overwrite | High |
| Risk Score | Number | Orca Risk Score | Overwrite | 6.5 |
| State | String | Orca State | Overwrite | Running |
| Exposure | String | Orca Exposure | Overwrite | public_facing |
| Is Internet Facing | Boolean | Orca Is Internet Facing | Overwrite | true |
| Is Crown Jewel | Boolean | Orca Is Crown Jewel | Overwrite | false |
| Crown Jewel Score | Number | Orca Crown Jewel Score | Overwrite | 8 |
| Crown Jewel Reason | String | Orca Crown Jewel Reason | Overwrite | Contains PII |
| Public IP | String | Orca Public IP Address | Overwrite | 54.23.1.10 |
| Private IP | String | Orca Private IP Address | Overwrite | 10.0.0.5 |
| Public DNS | List | Orca Public DNS Name | Overwrite | [“ec2-54-23-1-10.compute.amazonaws.com”] |
| Private DNS | List | Orca Private DNS Name | Overwrite | [“ip-10-0-0-5.ec2.internal”] |
| MAC Addresses | List | Orca MAC Address | Overwrite | [“02:1a:2b:3c:4d:5e”] |
| Region | String | Orca Region | Overwrite | us-east-1 |
| Availability Zones | List | Orca Availability Zone | Overwrite | [“us-east-1a”] |
| Matched CVEs | List | Orca Matched CVEs | Overwrite | [“CVE-2024-1234”] |
| Max CVSS Score | Number | Orca Max CVSS Score | Overwrite | 9.8 |
| Tags | List | Orca Tags | Overwrite | [“env: production”] |
| Model Tags | List | Orca Model Tags | Overwrite | [“owner: platform-team”] |
| Netskope Normalized Score | Number | Orca Netskope Normalized Score | Overwrite | 350 |
| Alerts Count | Number | Alerts Count | Overwrite | 3 |
| Login Attempts Count | Number | Orca Login Attempts Count | Overwrite | 0 |
| Vulnerability Count | Number | Orca Vulnerability Count | Overwrite | 12 |
| Ports | List | Orca Open Ports | Overwrite | [443, 8080] |
| Port Services | List | Orca Port Services | Overwrite | [“https”] |
| Port Protocols | List | Orca Port Protocols | Overwrite | [“tcp”] |
| Custom Tags | List | Orca Custom Tags | Overwrite | [“team: security”] |
Pull Mapping for Users
| Plugin Field Label | Expected Data Type | Suggested Field Label | Aggregate Strategy | Example |
|---|---|---|---|---|
| Entity Unique ID | String | Orca Unique Identity ID | Unique (Keep this Overwrite if you want to merge records with Netskope Risk Exchange plugin) | b2c3d4e5-f6a7-8901-bcde-f23456789012 |
| Entity ID | String | Orca Identity ID | Overwrite | orca-user-id-54321 |
| String | Overwrite (Keep this unique if you want to merge records with Netskope Risk Exchange plugin) | jane.doe@example.com | ||
| Display Name | String | Orca Display Name | Overwrite | Jane Doe |
| Type | String | Orca Identity Type | Overwrite | AwsUser |
| Cloud Provider | String | Orca Cloud Provider | Overwrite | AWS |
| Category | String | Orca Identity Category | Overwrite | Identity |
| Risk Level | String | Orca Risk Level | Overwrite | Medium |
| Risk Score | Number | Orca Risk Score | Overwrite | 4.2 |
| State | String | Orca State | Overwrite | Active |
| Tags | List | Orca Tags | Overwrite | [“dept: finance”] |
| Model Tags | List | Orca Model Tags | Overwrite | [“managed-by: iam-team”] |
| Netskope Normalized Score | Number | Orca Netskope Normalized Score | Overwrite | 580 |
| Custom Tags | List | Orca Custom Tags | Overwrite | [“reviewed: true”] |
To merge records between Netskope Tenant and Orca Security , you need to keep one field as unique and common between both the plugins. Example: If you have common users with the same email on Netskope Tenant as well as Orca Security tenant then you can keep the Email field as a common and unique field between the Netskope Risk Exchange plugin and Orca Security plugin to merge the pulled records.
Permissions
API Token must have an Editor role.
API Details
List of APIs Used
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/serving-layer/query | POST | Pull Workload and User records; fetch open ports data; connectivity check |
| /api/serving-layer/linked_entities_count | POST | Fetch Alerts, Login Attempts, and Vulnerability counts for Workloads |
| /api/manual_tags/{asset_id} | GET | Fetch Custom Tags for a Workload or User |
| /api/manual_tags/{asset_id} | POST | Add a Custom Tag to a Workload or User |
| /api/manual_tags/{asset_id} | DELETE | Remove a Custom Tag from a Workload or User |
| /api/scan/asset/{asset_unique_id} | POST | Trigger an on-demand scan for a Workload or User |
Query Assets
Endpoint: POST /api/serving-layer/query
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Request Body
{
"query": {
"type": "object_set",
"models": [
"AwsEc2Instance",
"AzureComputeVm",
"AzureContainerInstance",
"GcpVmInstance",
"OciComputeVmInstance"
]
},
"get_results_and_count": true,
"start_at_index": 0,
"limit": 100
}
Sample Response
{
"status": "success",
"data": [
{
"id": "e739eb76-324e-d680-bb39-94ba3aec1bf7",
"type": "OciComputeVmInstance",
"data": {
"AgentConfiguration": {
"value": {
"areAllPluginsDisabled": false,
"isManagementDisabled": false,
"isMonitoringDisabled": false,
"pluginsConfig": [
{
"desiredState": "DISABLED",
"name": "Vulnerability Scanning"
},
{
"desiredState": "DISABLED",
"name": "Oracle Java Management Service"
},
{
"desiredState": "DISABLED",
"name": "Oracle Autonomous Linux"
},
{
"desiredState": "DISABLED",
"name": "OS Management Service Agent"
},
{
"desiredState": "DISABLED",
"name": "OS Management Hub Agent"
},
{
"desiredState": "DISABLED",
"name": "Management Agent"
},
{
"desiredState": "ENABLED",
"name": "Custom Logs Monitoring"
},
{
"desiredState": "DISABLED",
"name": "Compute RDMA GPU Monitoring"
},
{
"desiredState": "ENABLED",
"name": "Compute Instance Run Command"
},
{
"desiredState": "ENABLED",
"name": "Compute Instance Monitoring"
},
{
"desiredState": "DISABLED",
"name": "Compute HPC RDMA Auto-Configuration"
},
{
"desiredState": "DISABLED",
"name": "Compute HPC RDMA Authentication"
},
{
"desiredState": "ENABLED",
"name": "Cloud Guard Workload Protection"
},
{
"desiredState": "DISABLED",
"name": "Block Volume Management"
},
{
"desiredState": "DISABLED",
"name": "Bastion"
}
]
}
},
"AutoUpdatesStatus": {
"value": "on"
},
"AvailabilityConfiguration": {
"value": {
"isLiveMigrationPreferred": null,
"recoveryAction": "RESTORE_INSTANCE"
}
},
"AvailabilityDomain": {
"value": "Lhkx:US-ASHBURN-AD-2"
},
"AvailabilityZones": {
"value": [
"Lhkx:US-ASHBURN-AD-2"
]
},
"CVECount": {
"value": {
"In-2017": 1,
"In-2024": 450,
"In-2025": 1848,
"In-2026": 1794,
"LastYear": 1848,
"TwoYearsAgo": 450
}
},
"Category": {
"value": "VM"
},
"ConsoleUrlLink": {
"value": "https://cloud.oracle.com/compute/instances/ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq?region=us-ashburn-1"
},
"CpuFamily": {
"value": "AMD"
},
"CreationTime": {
"value": "2024-09-19T22:40:35+00:00"
},
"DetectedCrownJewelReason": {
"value": "Sensitive Data"
},
"DetectedCrownJewelScore": {
"value": 75
},
"DisksInfo": {
"value": [
"{'size_bytes': 50010783744, 'size': '46.58 GB', 'used_bytes': 6843484160, 'used': '6.37 GB', 'volume_id': 'ocid1.bootvolume.oc1.iad.abuwcljspo2bszfbfhmxpif22vr7lumcdffcxnp4xhpwjl6juyv3foy7duiq'}"
]
},
"DistributionInfoSite": {
"value": "https://ubuntu.com/"
},
"DistributionMajorVersion": {
"value": "24"
},
"DistributionName": {
"value": "Ubuntu"
},
"DistributionVersion": {
"value": "24.04"
},
"DistroCategory": {
"value": "debian"
},
"EnableSecureBoot": {
"value": false
},
"EsmStatus": {
"value": "disabled"
},
"Exposure": {
"value": "public_facing"
},
"FaultDomain": {
"value": "FAULT-DOMAIN-2"
},
"FirstSeen": {
"value": "2026-02-04T12:48:17+00:00"
},
"HasMalwareWithHighConfidence": {
"value": false
},
"HasSensitiveKeys": {
"value": false
},
"Hostname": {
"value": "shw-helper-ubuntu"
},
"ImageId": {
"value": "ocid1.image.oc1.iad.aaaaaaaa5by4latw3wcb7ekg4xyj2v6k2bnuebtrw5iiqmy6igxqzox45byq"
},
"IngressPorts": {
"value": [
"0-65535"
]
},
"InstanceId": {
"value": "ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
},
"InstanceShape": {
"value": "VM.Standard.E5.Flex"
},
"InstanceType": {
"value": "VM.Standard.E5.Flex"
},
"IsCrownJewel": {
"value": true
},
"IsIMDSV2Required": {
"value": false
},
"IsInternetFacing": {
"value": true
},
"KernelVersion": {
"value": "6.8.0-1022-oracle"
},
"LastSeen": {
"value": "2026-08-19T03:06:26+00:00"
},
"LastUpdateTime": {
"value": "2026-01-07T06:12:16+00:00"
},
"LaunchMode": {
"value": "PARAVIRTUALIZED"
},
"LaunchOptions": {
"value": {
"bootVolumeType": "PARAVIRTUALIZED",
"firmware": "UEFI_64",
"isConsistentVolumeNamingEnabled": true,
"isEncryptionInTransitEnabled": null,
"isPvEncryptionInTransitEnabled": false,
"networkType": "PARAVIRTUALIZED",
"remoteDataVolumeType": "PARAVIRTUALIZED"
}
},
"MacAddresses": {
"value": []
},
"MatchedCVEs": {
"value": 4093
},
"MaxCVSSScore": {
"value": 10.0
},
"ModelTags": {
"value": {
"Category": "Compute"
}
},
"Name": {
"value": "shw-helper-ubuntu-24"
},
"NewCategory": {
"value": "Compute Services"
},
"NewSubCategory": {
"value": "Virtual Instances"
},
"NumberOfContainers": {
"value": 1
},
"Observations": {
"value": [
"public_facing",
"sensitive_data"
]
},
"OciState": {
"value": "STOPPED"
},
"OrcaScore": {
"value": 10.0
},
"OrcaTags": {
"value": {}
},
"OsEndOfSupport": {
"value": "2029-04-30T00:00:00+00:00"
},
"OsSupportInfoSite": {
"value": "https://wiki.ubuntu.com/Releases"
},
"PiiTypes": {
"value": []
},
"PrivateDnss": {
"value": []
},
"PrivateIps": {
"value": [
"10.88.0.168"
]
},
"PublicDnss": {
"value": []
},
"PublicIps": {
"value": [
"150.136.78.78"
]
},
"Region": {
"value": "us-ashburn"
},
"Regions": {
"value": [
"us-ashburn"
]
},
"RegionsNames": {
"value": []
},
"RelatedCompliances": {
"value": [
"HITRUST Level 1 v11.0.0",
"ISO 27001 2022",
"US MARS-E Volume 1 2.2.0",
"NZISM (New Zealand Information Security Manual)",
"EU NIS (Network and Information Security) v2",
"US ARC-AMPE Volume 2",
"CIS Ubuntu Linux 24.04 Benchmark",
"Indian DPDPA (Digital Personal Data Protection Act)",
"NIST 800-171 (Rev 2)",
"US CMMC (Cybersecurity Maturity Model Certification) Level 2",
"HITRUST Level 2 v11.0.0",
"US GLBA (Gramm-Leach-Bliley Act) Standards For Safeguarding Customer Information",
"India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) 1.0.1 (Aug 2024)",
"Indonesian PDPL (Personal Data Protection Law)",
"NIST 800-172",
"CIS Oracle Cloud Infrastructure Foundations Benchmark 2.0.0",
"AU Essential 8 Maturity Level 1 November 2022",
"CIS Controls v8.1.2",
"UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 4.0.0",
"CSA CCM Lite v4.0.13",
"MITRE ATT&CK v13",
"test",
"Orca Identity & Access Best Practices",
"Privacy Shield",
"Hong Kong PDPO (Personal Data Privacy Ordinance)",
"HITRUST Level 3 v9.6.0",
"ISO 27018 2019",
"CIS Oracle Cloud Infrastructure Foundations Benchmark 3.0.0",
"MPA (Motion Picture Association) 5.3.0",
"Multi-Level Protection Scheme 2.0 (Level 3)",
"NIST 800-53 (Rev 5.1.1)",
"CIS Docker Benchmark 1.3.1",
"US FERPA (Family Educational Rights and Privacy Act)",
"US CJIS (Criminal Justice Information Services) 5.8.0",
"Spain National Security Scheme",
"FedRAMP",
"ISO 27701",
"CMORG Cloud Control Framework",
"US COPPA (Children’s Online Privacy Protection)",
"OWASP NHI Top Ten",
"CSA CCM v4.0.5",
"Singapore PDPA (Personal Data Protection Act)",
"Canada PIPEDA (Personal Information Protection and Electronic Documents Act)",
"AU Essential 8 Maturity Level 3 November 2022",
"AU Essential 8 Maturity Level 2 November 2022",
"NYDFS (New York Department of Financial Services)",
"SOC 2",
"Japan FISC Security Guidelines on Computer Systems for Financial Institutions 11th Edition",
"RBI (Reserve Bank of India)",
"Telecommunications Security Code of Practice",
"MPA (Motion Picture Association) 5.0.0",
"South Korea ISMS-P (Personal information & Information Security Management System)",
"PCI DSS 3.2.1",
"EU DORA (Digital Operational Resilience Act)",
"HITRUST Level 3 v11.0.0",
"ISM (Australian Government Information Security Manual) September 2022",
"DSPM (Data Security Posture Management) Best Practices",
"HIPAA",
"MASTRM (Monetary Authority of Singapore Technology Risk Management)",
"China PIPL (Personal Information Protection Law)",
"CPRA (California Privacy Rights Act)",
"ISM (Australian Government Information Security Manual) March 2024",
"US FFIEC (Federal Financial Institutions Examination Council)",
"ISO 27002 2022",
"LGPD (Brazilian General Data Protection)",
"ISM (Australian Government Information Security Manual) March 2026",
"CIS Controls v8",
"APRA CPS 234 Information Security",
"PCI DSS 4.0.0",
"NIST 800-190",
"Indian DPDPA (Digital Personal Data Protection Act) 2025",
"Orca Best Practices 2.0.0",
"AU Essential 8 Maturity Level 2 November 2023",
"SOX 404",
"Japan FISC Security Guidelines on Computer Systems for Financial Institutions 13th Edition",
"NERC CIP (Critical Infrastructure Protection)",
"UK Cyber Essentials",
"GDPR",
"Swift CSCF (Customer Security Controls Framework)",
"AU Essential 8 Maturity Level 1 November 2023",
"PCI DSS 4.0.1",
"NIST 800-53 (Rev 5)",
"ISO 27017",
"CCPA",
"US CJIS (Criminal Justice Information Services) 6.0.0",
"NIST 800-53 (Rev 4)",
"CIS Oracle Cloud Infrastructure Foundations Benchmark 1.2.0",
"India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework)",
"AU Essential 8 Maturity Level 3 November 2023",
"NIST CSF 2.0.0",
"MITRE ATT&CK v12",
"ISO 27001 2013",
"Germany TISAX VDA",
"Orca for Post Quantum Cryptography",
"NIST 800-171 (Rev 3)",
"UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 3.1.0"
]
},
"RiskLevel": {
"value": "critical"
},
"Score": {
"value": 3
},
"SourceType": {
"value": "image"
},
"State": {
"value": "stopped"
},
"StopDate": {
"value": "2026-02-04T12:48:13+00:00"
},
"SubCategory": {
"value": "VM"
},
"Tags": {
"value": {
"Lifetime": "Long Term",
"Oracle-Tags-CreatedBy": "oktasso_qualys_oraclecengg1/saher@qualys.com",
"Oracle-Tags-CreatedOn": "'2024-09-19T22:40:34.067Z'",
"Owner": "Shweta Aher"
}
},
"TotalDisksBytes": {
"value": 50010783744
},
"TotalVulnerabilitiesFound": {
"value": 6419
},
"Type": {
"value": "OciComputeVmInstance"
},
"UiUniqueField": {
"value": "ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
},
"UpdatedTime": {
"value": "2026-01-07T06:12:16+00:00"
},
"Zones": {
"value": [
"Lhkx:US-ASHBURN-AD-2"
]
},
"AssetUniqueId": {
"value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
},
"bu_tags": {
"value": ",-32325982428363234,"
},
"cluster_unique_id": {
"value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
},
"full_scan_time": {
"value": "2026-08-19T01:38:59+00:00"
},
"GroupUniqueId": {
"value": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
}
},
"name": "shw-helper-ubuntu-24",
"group_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
"cluster_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
"asset_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq",
"last_seen": "2026-08-19T03:50:49+00:00"
}
],
"total_items": 1142
}
Query Users
Endpoint: POST /api/serving-layer/query
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Request Body
{
"query": {
"type": "object_set",
"models": [
"GcpUser",
"AwsUser",
"OciUser",
"AzureUser",
"AzureServicePrincipal",
"GcpIamServiceAccount",
"K8sServiceAccount"
]
},
"get_results_and_count": true,
"start_at_index": 0,
"limit": 100
}
Sample Response
{
"status": "success",
"data": [
{
"id": "e739eb76-3b38-9580-8805-1c9b10b4b088",
"type": "AzureServicePrincipal",
"data": {
"AppId": {
"value": "076af1ed-de03-4981-9ed2-066f89d2aafe"
},
"AppOwnerOrganizationId": {
"value": "ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb"
},
"AzureId": {
"value": "ef893edf-6aab-494b-b037-935e7a237cb5"
},
"Category": {
"value": "Users and Access"
},
"CreationTime": {
"value": "2024-02-27T05:44:00+00:00"
},
"Exposure": {
"value": "N/A"
},
"FirstSeen": {
"value": "2026-01-20T05:05:57+00:00"
},
"IdentityId": {
"value": "ef893edf-6aab-494b-b037-935e7a237cb5"
},
"IsCrownJewel": {
"value": false
},
"IsEnabled": {
"value": true
},
"IsInternal": {
"value": true
},
"IsTrusted": {
"value": true
},
"LastSeen": {
"value": "2026-08-19T22:32:09+00:00"
},
"Name": {
"value": "aro-app-1709012625479"
},
"NewCategory": {
"value": "Identity and Access"
},
"NewSubCategory": {
"value": "Cloud Non-Human Identities (NHI)"
},
"Observations": {
"value": []
},
"OrcaScore": {
"value": 1.0
},
"PrincipalId": {
"value": "ef893edf-6aab-494b-b037-935e7a237cb5"
},
"RelatedCompliances": {
"value": [
"APRA CPS 234 Information Security",
"AU Essential 8 Maturity Level 1 November 2023",
"AU Essential 8 Maturity Level 2 November 2023",
"AU Essential 8 Maturity Level 3 November 2022",
"AU Essential 8 Maturity Level 3 November 2023",
"Azure Well-Architected",
"CCPA",
"CIS Azure Kubernetes Service (AKS) Benchmark 1.7.0",
"CIS Controls v8",
"CIS Controls v8.1.2",
"CIS Microsoft Azure Foundations Benchmark 5.0.0",
"CIS Microsoft Azure Foundations Benchmark 6.0.0",
"CMORG Cloud Control Framework",
"CPRA (California Privacy Rights Act)",
"CSA CCM Lite v4.0.13",
"CSA CCM v4.0.5",
"Canada PIPEDA (Personal Information Protection and Electronic Documents Act)",
"China PIPL (Personal Information Protection Law)",
"DSPM (Data Security Posture Management) Best Practices",
"EU DORA (Digital Operational Resilience Act)",
"EU NIS (Network and Information Security) v2",
"FedRAMP",
"GDPR",
"Germany TISAX VDA",
"HIPAA",
"HITRUST Level 1 v11.0.0",
"HITRUST Level 2 v11.0.0",
"HITRUST Level 3 v11.0.0",
"HITRUST Level 3 v9.6.0",
"Hong Kong PDPO (Personal Data Privacy Ordinance)",
"ISM (Australian Government Information Security Manual) March 2024",
"ISM (Australian Government Information Security Manual) March 2026",
"ISM (Australian Government Information Security Manual) September 2022",
"ISO 27001 2013",
"ISO 27001 2022",
"ISO 27002 2022",
"ISO 27017",
"ISO 27018 2019",
"India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework)",
"India SEBI CSCRF (Cybersecurity and Cyber Resilience Framework) 1.0.1 (Aug 2024)",
"Indian DPDPA (Digital Personal Data Protection Act)",
"Indian DPDPA (Digital Personal Data Protection Act) 2025",
"Indonesian PDPL (Personal Data Protection Law)",
"Japan FISC Security Guidelines on Computer Systems for Financial Institutions 11th Edition",
"Japan FISC Security Guidelines on Computer Systems for Financial Institutions 13th Edition",
"LGPD (Brazilian General Data Protection)",
"MASTRM (Monetary Authority of Singapore Technology Risk Management)",
"MCSB (Microsoft Cloud Security Benchmark)",
"MITRE ATT&CK v12",
"MITRE ATT&CK v13",
"MPA (Motion Picture Association) 5.3.0",
"Multi-Level Protection Scheme 2.0 (Level 3)",
"NERC CIP (Critical Infrastructure Protection)",
"NIST 800-171 (Rev 2)",
"NIST 800-171 (Rev 3)",
"NIST 800-172",
"NIST 800-53 (Rev 4)",
"NIST 800-53 (Rev 5)",
"NIST 800-53 (Rev 5.1.1)",
"NIST CSF",
"NIST CSF 2.0.0",
"NYDFS (New York Department of Financial Services)",
"NZISM (New Zealand Information Security Manual)",
"OWASP NHI Top Ten",
"Orca Best Practices",
"Orca Best Practices 2.0.0",
"Orca Identity & Access Best Practices",
"Orca for Post Quantum Cryptography",
"PCI DSS 3.2.1",
"PCI DSS 4.0.0",
"PCI DSS 4.0.1",
"Privacy Shield",
"RBI (Reserve Bank of India)",
"SOC 2",
"SOX 404",
"Singapore PDPA (Personal Data Protection Act)",
"South Korea ISMS-P (Personal information & Information Security Management System)",
"Spain National Security Scheme",
"Swift CSCF (Customer Security Controls Framework)",
"Telecommunications Security Code of Practice",
"UK Cyber Essentials",
"UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 3.1.0",
"UK NCSC CAF (National Cyber Security Centre Cyber Assessment Framework) 4.0.0",
"US ARC-AMPE Volume 2",
"US CJIS (Criminal Justice Information Services) 5.8.0",
"US CJIS (Criminal Justice Information Services) 6.0.0",
"US CMMC (Cybersecurity Maturity Model Certification) Level 2",
"US COPPA (Children’s Online Privacy Protection)",
"US FERPA (Family Educational Rights and Privacy Act)",
"US FFIEC (Federal Financial Institutions Examination Council)",
"US GLBA (Gramm-Leach-Bliley Act) Standards For Safeguarding Customer Information",
"US MARS-E Volume 1 2.2.0",
"test"
]
},
"RiskLevel": {
"value": "informational"
},
"Score": {
"value": 4
},
"ServicePrincipalNames": {
"value": [
"076af1ed-de03-4981-9ed2-066f89d2aafe"
]
},
"ServicePrincipalType": {
"value": "Application"
},
"SubCategory": {
"value": "ManagedIdentities"
},
"Type": {
"value": "AzureServicePrincipal"
},
"UiUniqueField": {
"value": "ef893edf-6aab-494b-b037-935e7a237cb5"
},
"Zones": {
"value": []
},
"AssetUniqueId": {
"value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
},
"bu_tags": {
"value": ",-32325982428363234,-1894962669124995387,2112785123256613438,-4124477540523243805,-7644646143476473755,-7911719698443582879,-3252461980860312900,"
},
"cluster_unique_id": {
"value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
},
"full_scan_time": {
"value": "2026-08-19T22:32:03+00:00"
},
"GroupUniqueId": {
"value": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902"
}
},
"name": "aro-app-1709012625479",
"group_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
"cluster_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
"asset_unique_id": "AzureServicePrincipal_ff4e2413-65ab-4dc2-9e5b-1ea02d3d94eb_e739eb76-2a3a-17ce-84bc-a1f8765d0902",
"last_seen": "2026-08-19T22:34:47+00:00"
}
],
"total_items": 6643
}
Fetch Linked Entity Counts
Endpoint: POST /api/serving-layer/linked_entities_count
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Request Body
{
"model": "OciComputeVmInstance",
"base_id": "{{asset_id}}"
}
Sample Response
{
"status": "success",
"data": {
"asset_id": "e739eb76-324e-d680-bb39-94ba3aec1bf7",
"links": [
{
"related_model": "AttackPathInventories",
"relation_key": "AttackPathInventories",
"reversed_relation_key": "Inventory",
"count": 2
},
{
"related_model": "Application",
"relation_key": "Applications",
"reversed_relation_key": "Compute",
"count": 5
},
{
"related_model": "Container",
"relation_key": "Containers",
"reversed_relation_key": "Vm",
"count": 1
},
{
"related_model": "Subnet",
"relation_key": "SubnetList",
"reversed_relation_key": "ComputeObjects",
"count": 1
},
{
"related_model": "InventoryCustomTags",
"relation_key": "CustomTags",
"reversed_relation_key": "inventory",
"count": 1
},
{
"related_model": "OciIdentityCompartment",
"relation_key": "Compartment",
"reversed_relation_key": "VmInstances",
"count": 1
},
{
"related_model": "OciVnic",
"relation_key": "OciVnics",
"reversed_relation_key": "Vm",
"count": 1
},
{
"related_model": "Alert",
"relation_key": "InventoryAlerts",
"reversed_relation_key": "Inventory",
"count": 263
},
{
"related_model": "Alert",
"relation_key": "Alerts",
"reversed_relation_key": "Inventories",
"count": 263
},
{
"related_model": "AssetScanStatus",
"relation_key": "AssetScanStatus",
"reversed_relation_key": "Inventory",
"count": 1
},
{
"related_model": "AssetSshKeyPair",
"relation_key": "AssetSshKeyPairs",
"reversed_relation_key": "Content",
"count": 4
},
{
"related_model": "ConfigurationFile",
"relation_key": "ConfigurationFiles",
"reversed_relation_key": "Content",
"count": 4
},
{
"related_model": "InstalledPackage",
"relation_key": "InstalledPackages",
"reversed_relation_key": "Content",
"count": 992
},
{
"related_model": "LocalPort",
"relation_key": "LocalPorts",
"reversed_relation_key": "Compute",
"count": 4
},
{
"related_model": "LoginAttempt",
"relation_key": "LoginAttempts",
"reversed_relation_key": "Compute",
"count": 38
},
{
"related_model": "OrcaScanStatus",
"relation_key": "OrcaLastScanStatus",
"reversed_relation_key": "Inventory",
"count": 1
},
{
"related_model": "PIIDirectory",
"relation_key": "PIIDirectories",
"reversed_relation_key": "Content",
"count": 7
},
{
"related_model": "Role",
"relation_key": "Roles",
"reversed_relation_key": "Compute",
"count": 1
},
{
"related_model": "RunningService",
"relation_key": "RunningServices",
"reversed_relation_key": "Compute",
"count": 42
},
{
"related_model": "ScanEngineData",
"relation_key": "ScanEngineData",
"reversed_relation_key": "Content",
"count": 1
},
{
"related_model": "SensitiveData",
"relation_key": "SensitiveData",
"reversed_relation_key": "Inventory",
"count": 16
},
{
"related_model": "SensitiveFile",
"relation_key": "SensitiveFiles",
"reversed_relation_key": "Content",
"count": 12
},
{
"related_model": "ShellHistoryFile",
"relation_key": "ShellHistoryFiles",
"reversed_relation_key": "Content",
"count": 2
},
{
"related_model": "ShellHistorySuspiciousCommand",
"relation_key": "ShellHistorySuspiciousCommands",
"reversed_relation_key": "Content",
"count": 1
},
{
"related_model": "SshAuthorizedKey",
"relation_key": "SshAuthorizedKeys",
"reversed_relation_key": "Content",
"count": 2
},
{
"related_model": "SshAuthorizedKeyFile",
"relation_key": "SshAuthorizedKeyFiles",
"reversed_relation_key": "Content",
"count": 3
},
{
"related_model": "SSHConfigurationFile",
"relation_key": "SSHConfigurationFiles",
"reversed_relation_key": "Content",
"count": 1
},
{
"related_model": "SshKey",
"relation_key": "SshKeys",
"reversed_relation_key": "Content",
"count": 6
},
{
"related_model": "VulnerabilityV2",
"relation_key": "VulnerabilityV2s",
"reversed_relation_key": "Inventory",
"count": 7105
},
{
"related_model": "CloudAccount",
"relation_key": "CloudAccount",
"reversed_relation_key": "vm",
"count": 1
},
{
"related_model": "CloudAccount",
"relation_key": "CloudAccount",
"reversed_relation_key": "compute",
"count": 1
},
{
"related_model": "CloudAccount",
"relation_key": "CloudAccount",
"reversed_relation_key": "content",
"count": 1
},
{
"related_model": "CloudAccount",
"relation_key": "CloudAccount",
"reversed_relation_key": "inventory",
"count": 1
},
{
"related_model": "CloudAccount",
"relation_key": "CloudAccount",
"reversed_relation_key": "ocicomputevminstance",
"count": 1
}
],
"from_cache": false
}
}
Fetch Custom Tags
Endpoint: GET /api/manual_tags/{asset_id}
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
Sample Response
{
"status": "success",
"data": {
"netskope-ce": "managed",
"cost-center": "CC-4471",
"owner": "platform-team"
}
}
Add Custom Tag
Endpoint: POST /api/manual_tags/{asset_id}
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Request Body
{
"tag_key": "netskope-ce",
"tag_value": "quarantine"
}
Sample Response
{
"status": "success",
"data": {
"asset_id": "b1f4c3d2-8a6e-4f19-9c07-2d5e7a1b8f43",
"tag_key": "netskope-ce",
"tag_value": "quarantine"
}
}
Remove Custom Tag
Endpoint: DELETE /api/manual_tags/{asset_id}
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Sample Request
{
"tag_key": "netskope-ce"
}
Sample Request
{
"status": "success",
"data": {
"asset_id": "b1f4c3d2-8a6e-4f19-9c07-2d5e7a1b8f43",
"tag_key": "netskope-ce"
}
}
Scan Data Now
Endpoint: POST /api/scan/asset/{asset_unique_id}
Request Headers
| Key | Value |
|---|---|
| Authorization | Token {api_token} |
| Content-Type | application/json |
Sample Response
{
"scan_unique_id": "req_73521d3c-d567-4f71-aeb8-ee19e12811ee",
"asset_unique_id": "vm_xn7itwhk7keokamq_ocid1.instance.oc1.iad.anuwcljschxdvzyc5s6pkckvj52t4q4u4s4lrtg7hd6md3zuogovb7lsohmq"
}
Performance Matrix
Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k Workloads and Users.
| Description | Specification |
|---|---|
| Stack details | Size: Large RAM: 32 GB CPU: 16 Cores |
| Workloads fetched and updated from Orca Security | ~95 minutes |
| Users fetched and updated from Orca Security | ~95 minutes |
User Agent
netskope-ce-6.1.0-cre-orca-security-v1.0.0
Workflow
- Get your Orca Security API Token.
- Configure the Orca Security plugin.
- Configure a Risk Exchange Business Rule.
- Configure Risk Exchange Actions.
- Validation
Watch a Video
Click play to watch a video:
Get your Orca Security API Token
-
Log in to your Orca Security instance. Go to Settings > API Token and click Add API Token.
-
Enter a Name, Description, and Expiration as per your needs, and then click Add.
-
Copy the generated token.
Configure the Orca Security Plugin
-
In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Orca Security v1.0.0 plugin.
-
Enter a plugin configuration name and change sync interval if needed.
-
Click Next and enter the Configuration Parameters:
- Base URL: Select the region of your Orca Security tenant. Select Custom to reveal a Custom Base URL field for tenants that use a different base URL.
- Custom Base URL: Only shown when Base URL is Custom; mandatory whenever shown. Full custom base URL for the Orca Security tenant, must include a URL scheme and network location.
- API Token: API Token for authenticating with the Orca platform you obtained earlier.
- Workload Types: Select Workload Types to pull the Workloads entity records. Leave empty to pull all Workloads entity records.
- User Types: Select User Types to pull the Users entity records. Leave empty to pull all Users entity records.
- Fetch Additional Workload Details: Select which additional Workload details to fetch during the update cycle. When Additional Workload Count Details is selected, an additional API call to
/serving-layer/linked_entities_countis made once per Workload to fetch Alerts Count, Login Attempts Count, and Vulnerability Count. When Additional Workload Ports Details is selected, an additional API call to/serving-layer/queryis made for public-facing workloads to fetch Ports, Port Services, and Port Protocols. - Fetch Custom Tags: When set to Yes, an additional API call to
/manual_tags/{asset_id}is made once per asset to fetch Custom Tags on both Workloads and Users.
-
Click Next and select the required Entity from the Entity dropdown. Provide the field mapping per your needs. You can create a new Entity by clicking Add New Entity.
To create a new field, click Add field.
Provide the Field Label, Data Type, Normalization, and Aggregate Strategy per your needs, and then click Save.
Map the created fields:
Similarly, here are the mapped fields for Users Entity:
Refer to the Mappings section before configuring the plugin. -
Click Save.
Add a Risk Exchange Business Rule for the Orca Security Plugin
-
Go to Risk Exchange > Business Rules and click Create New Rule.
-
Enter a Rule Name. Select the Entity for the Fields that were configured for the Orca Security plugin, and configure the query based on your requirements. This example filters the data fetched from the plugin.
-
Click Save.
Add Risk Exchange Actions for the Orca Security Plugin
The Orca Security pluginvsupports the following action types:
- Add/Remove Custom Tag: This action can be used to add or remove tags from supported Workloads and Users pulled from Orca Security Instance.
- Scan Data Now: This action can be used to trigger Scan Data Now action on the supported Workloads and Users pulled from the Orca Security Instance.
- No Action: No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.
You can perform multiple actions on the pulled records from Orca Security on the Netskope Tenant, for performing the related actions on Netskope refer to the Netskope Risk Exchange plugin guide.
Add/Remove Custom Tag
- Go to Risk Exchange > Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and Action from their respective dropdowns, and then enter these Action parameters:
- Tag Action: Whether to add or remove the tag on the asset. Select Static for the Tag Action from the dropdown.
- Tag Key: Key of the custom tag to add/remove. Select Static for the Tag Value from the dropdown. Note that multiple values are not allowed in this field.
- Tag Value: Value of the custom tag. Required when Tag Action is Add only. Select static field only. Note that multiple values are not allowed in this field.
- Entity ID: The Orca
idof the asset to tag/untag. Select the Entity ID source field to resolve it automatically from each Business Rule matched record, or enter one fixed static value to tag/untag a single specific asset regardless of which records matched. Note that multiple values are not allowed in this field.
- Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
- Click Save.
Scan Data Now
- Go to Risk Exchange > Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and Action from their respective dropdown and then fill the following action parameters:
Asset Unique ID: The Orca ‘asset_unique_id’ of the asset to scan. Select the Entity Unique ID for the Source field to resolve it automatically from each Business Rule matched record, or enter one fixed value to scan a single specific asset regardless of which records matched. Note that multiple values are not allowed in this field. - Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
- Click Save.
No Action
- Go to Risk Exchange > Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and Action from their respective dropdown.
- Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
- Click Save.
Validate the Orca Security Plugin
Validate in Cloud Exchange
Go to Risk Exchange and click Records. Select the Entity that was selected while configuring the field mapping to view the pulled records.
To verify the logs related to pulled records, go to the Settings > Logging and apply the filter with plugin name or plugin configuration name.
Action Validation
Logs for performed Add/Remove Custom Tag action:
Logs for performed Scan Data Now action:
Logs for performed No action:
When a pulled record matches one of the configured business rules, the configured action will be performed on the record. This can be seen in the Cloud Risk Exchange > Action Logs.
Validate in Orca Security
To view the available Assets(Users and Workloads) on Orca Security, log in to your Orca Security instance.
Go to the Inventory > Inventory Overview. This is the page from where the records will be pulled to the Cloud Exchange.
This plugin only supports pulling the Asset Category or Type: AWS EC2 Instance, Azure Compute VM Instance, Azure Container Instance, GCP Compute VM Instance, OCI Compute VM Instance, GCP User, AWS IAM User, OCI User, Azure User, Azure Service Principal, GCP IAM Service Account, K8s Service Account
Apply the filter with Asset Category to view the users. For example:
Click on any of the assets to view its details.
Similarly, you can filter the Workloads related category like below:
Click on any of the assets to open its details.
Action Validation
For Add/Remove Custom Tag, filter the particular asset and open its detailed view.
For Scan Data Now, you can check the notification on the Orca Security Instance
To check the Scan status open the detailed view for the particular asset.
Troubleshooting the Orca Security Plugin
Unable to configure the Orca Security plugin
If the plugin fails to save with an error, it could be due to one of the following reasons:
- The Base URL is incorrect or not reachable from the CE instance.
- The API Token is invalid or has expired or does not have sufficient permissions.
What to do: To solve the above-mentioned issue, follow the points mentioned below.
- Verify that the Base URL is the correct Orca Security instance URL
- Verify if the API Token is not expired and it has all necessary permissions. Refer to the Configuration on the Orca Security platform section.
Unable to pull records from the Orca Security plugin
If you are unable to pull asset records, it may be because the records are not available on Orca Security platform.
What to do: Verify whether the records are present on the Orca Security platform under the Workload Types and User Types used in the plugin configuration. Refer to the Validate in Orca Security section.
Known Behaviors
- Orca Security API gives 200 status code for Asset Unique ID’s that are not found on the orca instance, thus the action logs will show Success in Cloud Exchange.
- The Orca Security UI sometimes shows multiple records for one Asset Unique ID.
