orca-config-origin

Name: orca-config-origin
Availability: InStock
Author: Orca Security

Traces Orca alerts to their origin via metadata, code origins, and audit logs.

47|7|Updated May 3, 2026

Search Tags:#ownership #iac #orca #audit-logs #cdr #alert-origin #codeorigins

Ready to run

npx skills add https://github.com/orcasecurity/orca-skills --skill orca-config-origin

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: orca-config-origin
Source: https://github.com/orcasecurity/orca-skills/tree/main/skills/orca-config-origin
Command: npx skills add https://github.com/orcasecurity/orca-skills --skill orca-config-origin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traces Orca alerts back to who deployed it, what tool was used, what introduced the issue, and provides a full timeline of events to answer questions like "who created this", "where did this come from", and "trace back an alert".

Core Features & Use Cases

Identify deployment tool and actor for each alert
Link alerts to code origins and audit trails to reconstruct the origin chain
Provide remediation routing and ownership attribution for misconfigurations, vulnerabilities, and sensitive data exposures

Quick Start

Trace the origin of a given Orca alert by passing its ID, e.g., 'trace orca-3380725'.

Frequently Asked Questions about orca-config-origin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace who deployed a misconfiguration and what introduced the issue?▼

Trace alert origins by linking Orca alerts to CodeOrigins and audit logs to identify the deployment tool, actor, and root cause across AWS, Azure, and GCP. You get a complete origin chain timeline.

What is the best way to find ownership and deployment method for Orca security alerts?▼

Finding ownership and deployment method requires accessing alert metadata, asset details, and CDR queries to attribute the owner and reconstruct the full event timeline for remediation routing across your cloud environment.

Does alert origin tracing work with vulnerabilities and sensitive data exposures across AWS, Azure, and GCP?▼

Alert origin tracing works with misconfigurations, vulnerabilities, and sensitive data alerts across AWS, Azure, and GCP by using CodeOrigins and audit logs to build the complete origin chain for each security event.

How do I start tracing an Orca alert back to its code origins?▼

Start tracing an Orca alert by passing its ID, such as 'trace orca-3380725', to link the alert to code origins and audit trails that identify the owner and deployment method used.

Do I need access to audit logs and CDR queries to identify the root cause of an alert?▼

You need access to alert metadata, asset details, CodeOrigins, and CDR queries to identify the owner, deployment method, root cause, and recommended remediation routing for the alert.