skills.rest
orcasecurity
orcasecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

orca-config-origin

Traces Orca alerts to their origin via metadata, code origins, and audit logs.

47|7|Updated May 3, 2026
Search Tags:#ownership#iac#orca#audit-logs#cdr#alert-origin#codeorigins
One-click install
npx skills add https://github.com/orcasecurity/orca-skills --skill orca-config-origin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: orca-config-origin
Source: https://github.com/orcasecurity/orca-skills/tree/main/skills/orca-config-origin
Command: npx skills add https://github.com/orcasecurity/orca-skills --skill orca-config-origin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traces Orca alerts back to who deployed it, what tool was used, what introduced the issue, and provides a full timeline of events to answer questions like "who created this", "where did this come from", and "trace back an alert".

Core Features & Use Cases

  • Identify deployment tool and actor for each alert
  • Link alerts to code origins and audit trails to reconstruct the origin chain
  • Provide remediation routing and ownership attribution for misconfigurations, vulnerabilities, and sensitive data exposures

Quick Start

Trace the origin of a given Orca alert by passing its ID, e.g., 'trace orca-3380725'.

Frequently Asked Questions about orca-config-origin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace who deployed a misconfiguration and what introduced the issue?▼

Trace alert origins by linking Orca alerts to CodeOrigins and audit logs to identify the deployment tool, actor, and root cause across AWS, Azure, and GCP. You get a complete origin chain timeline.

What is the best way to find ownership and deployment method for Orca security alerts?▼

Finding ownership and deployment method requires accessing alert metadata, asset details, and CDR queries to attribute the owner and reconstruct the full event timeline for remediation routing across your cloud environment.

Does alert origin tracing work with vulnerabilities and sensitive data exposures across AWS, Azure, and GCP?▼

Alert origin tracing works with misconfigurations, vulnerabilities, and sensitive data alerts across AWS, Azure, and GCP by using CodeOrigins and audit logs to build the complete origin chain for each security event.

How do I start tracing an Orca alert back to its code origins?▼

Start tracing an Orca alert by passing its ID, such as 'trace orca-3380725', to link the alert to code origins and audit trails that identify the owner and deployment method used.

Do I need access to audit logs and CDR queries to identify the root cause of an alert?▼

You need access to alert metadata, asset details, CodeOrigins, and CDR queries to identify the owner, deployment method, root cause, and recommended remediation routing for the alert.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

securing-azure-with-microsoft-defender

Deploy Defender for Cloud across Azure, AWS, and GCP to establish security posture baselines.

Community
Advanced
KentoShimizuKentoShimizu
7

git-history-investigation

Trace git commit chains from symptom to root cause using log, diff, and blame.

Community
Advanced
IldarMinaevIldarMinaev
1

postgresql-log-analyzer

Analyzes Patroni and PostgreSQL logs to identify and correlate error patterns across Kubernetes clusters.

Community
Advanced
incidentfoxincidentfox
654

splunk-analysis

Investigate Splunk logs to identify root causes using SPL queries.

Official
Intermediate