Orca Security skills for Claude Code, Codex, and Cursor

"What is this alert and should I care?"

Intelligent alert triage that transforms raw Orca alerts into analyst-friendly summaries with behavioral timelines, risk assessment, and progressive disclosure. Supports anomalies, vulnerabilities, malware, and misconfigurations.

Features:

• Verdict-first summaries with confidence scoring (Likely Benign, Active Threat, Patchable Risk, etc.)
• Visual timeline analysis showing alert behavior, status changes, and remediation blockers
• Blast radius calculation with related asset and alert correlation
• Orca-first automated investigation — queries CloudTrail, related alerts, attack paths before suggesting manual steps
• Remediation format picker — choose Terraform, CloudFormation, ARM/Bicep, Pulumi, CLI, or step-by-step instructions
• Code output written to files automatically (e.g., remediate-orca-3456789.tf)

Usage:

# Triage an alert
/orca-alert-triage orca-1234567

# Or use natural language
triage alert orca-9012345
explain orca-2345678

Follow-up commands (type after triage):

investigate    # Automated Orca-first investigation with manual steps only for gaps
evidence       # Detailed metadata, hashes, links, MITRE ATT&CK mappings
remediate      # Choose output format, then get remediation written to a file
correlate      # Related alerts and attack pattern analysis

Example output:

═══════════════════════════════════════════════════════════════════
ANOMALY DETECTION: Unusual User Agent on EKS Node Role
═══════════════════════════════════════════════════════════════════

VERDICT: Likely Benign | CONFIDENCE: 90% | ACTION: Review & Close | TIMELINE: 48h

WHAT HAPPENED:
  EKS node role used a new AWS SDK version (boto3/1.35.x → 1.36.x)
  during routine cluster operations. Single occurrence, no recurrence.

WHY IT MATTERS:
  Risk Level: Low (Orca Score: 3.0)
  Same tool family, minor version bump, clean 30-day baseline.
═══════════════════════════════════════════════════════════════════

Full Documentation →

"If I fix this, what closes — and what breaks?"

Analyzes the full remediation impact of fixing a single Orca alert — both the security gains (alerts closed, attack paths broken, compliance passed) AND the operational risk (production workflows, automation, services that might break).

Features:

• Cascade analysis — maps all alerts that share the same root cause as the target alert
• Attack path impact — identifies kill chains that break when the alert is fixed
• Compliance score change — shows before/after compliance percentages per framework
• Environment-wide view — finds the same issue across other assets and accounts
• Breakage simulation — analyzes CloudTrail/CDR events and effective permissions to identify production dependencies
• Executive verdict — clear FIX NOW / FIX WITH CAUTION / PLAN FIX / DEFER recommendation balancing security gain vs. operational risk
• Safe deployment checklist — steps to apply the fix without breaking production

Usage:

# Analyze impact of fixing an alert
/orca-impact-analysis orca-3456789

# Or use natural language
what's the impact of fixing orca-5678901?
if I fix orca-0123456, what else closes?

Example output:

═══════════════════════════════════════════════════════════════════
IMPACT ANALYSIS — orca-3456789
Root Account Without MFA Enabled
"If I enable MFA on root, what closes — and what breaks?"
═══════════════════════════════════════════════════════════════════

┌─────────────────────────────────────────────────────────────────┐
│  VERDICT: FIX NOW                                               │
│                                                                 │
│  Security gain:   HIGH — 2 critical alerts, 3 attack paths      │
│  Breakage risk:   LOW — no automation uses root console login   │
│  Blast radius:    2 alerts, 3 attack paths, 8 frameworks        │
└─────────────────────────────────────────────────────────────────┘

REMEDIATION IMPACT SUMMARY:
  Alerts directly closed:    2 (including this one)
  Attack paths broken:       3
  Compliance frameworks:     8 frameworks improved

  COMPLIANCE SCORE CHANGE:
    Framework              Current    After Fix    Change
    ─────────────────────────────────────────────────────
    PCI DSS v4.0.1          87%   →    89%         +2%
    NIST 800-53             91%   →    93%         +2%

BREAKAGE RISK:
  [ok] EKS automation — uses access keys (MFA doesn't apply)
  [ok] Orca scanner — uses service role (not affected)
  [x]  Unknown Kali agent — SHOULD break (that's the goal)

BOTTOM LINE: High-leverage, low-risk fix. Apply immediately.
═══════════════════════════════════════════════════════════════════

Full Documentation →

"Who did this, how was it deployed, and what introduced the issue?"

Traces any Orca alert — misconfiguration, vulnerability, sensitive data, or anomaly — back through cloud audit logs, Orca CodeOrigins (Shift Left), and asset metadata to find who created the resource, what tool deployed it, what introduced the specific issue, and a full timeline from deployment to alert detection.

Features:

• Alert category classification — traces origin differently for misconfigurations (config IS the cause), vulnerabilities (package is the cause), sensitive data (image/script placed the secret), and anomalies (actor IS the finding)
• CodeOrigins / Shift Left integration — extracts exact IaC source code (repo, file, line numbers, git blame author/commit)
• Audit log tracing via Orca CDR (CloudTrail, Azure Activity Log, GCP Audit Log)
• Full visual timeline from IaC code commit → resource creation → issue introduction → alert detection, with exposure window calculation
• Split ownership — distinguishes resource owner (who deployed) from issue owner (who should fix)
• IaC drift detection — flags resources created by IaC but later modified via Console
• Category-aware remediation routing — tells you WHERE to apply the fix based on alert type AND deployment method

Usage:

# Trace origin of any alert
/orca-config-origin orca-3456789

# Or use natural language
who created this misconfiguration? orca-3456789
trace back orca-5678901
where did this config come from? orca-3364845

Example output (vulnerability alert):

═══════════════════════════════════════════════════════════════════
CONFIG ORIGIN — orca-4567890
Apache Log4j Remote Code Execution Vulnerability (CVE-2021-45046)
═══════════════════════════════════════════════════════════════════

ASSET: web-bastion-host (AwsEc2Instance) in 123456789012
ISSUE: log4j-core v2.3 installed — critically vulnerable to RCE

┌─────────────────────────────────────────────────────────────────┐
│  DEPLOYED BY: Terraform (module "ec2_unpatched")                │
│  OWNER:       Alex Chen (alex@example-corp.com)                       │
│  ROOT CAUSE:  user_data script installs log4j-core-2.3.jar     │
│  LAST CHANGE: 2025-12-01 (137 days ago)                         │
│  METHOD:      Terraform → module "ec2/unpatched_ubuntu"         │
└─────────────────────────────────────────────────────────────────┘

TIMELINE:
  2024-06-23  ● Terraform code committed                  Alex Chen
              │ file: ec2.tf:71-80, commit: abc1234
  2025-12-01  ● Instance created — user_data installs log4j 2.3
              │ ⚠ VULNERABILITY INTRODUCED HERE
  2025-12-01  ● Alert detected by Orca (73 min after creation)
  2026-04-17  ● Today — 137 days exposed, still open

REMEDIATION ROUTING:
  ⚠ The fix is NOT in ec2.tf — the Terraform deploys correctly.
  FIX IN: module.scripts.ec2_unpatched (the user_data script)
  → Update script to install log4j-core ≥ 2.16.0
═══════════════════════════════════════════════════════════════════

Full Documentation →

"What happened while I was away, and what needs my attention?"

Daily security briefing for the last 24-72 hours. Scans your environment for new critical alerts, escalated findings, attack path changes, compliance drift, exposure changes, CDR activity anomalies, crown jewel risks, and aging unactioned alerts — then presents it all as a scannable dashboard with drill-down sections.

Features:

• Environment pulse — quick health assessment (stable, degrading, needs attention)
• New critical/high alerts with priority ranking
• Escalated alerts — severity increases and reopened findings
• Compliance drift — framework scores that dropped, with account breakdown
• CDR activity overview — event volumes, unusual actors, suspicious patterns
• Crown jewel risk — new alerts on your most critical assets
• Aging criticals — unactioned alerts with Jira ticket status
• Progressive disclosure — dashboard first (~20 lines), drill down by keyword
• Time range support — 24h (daily), 72h (Monday morning), week (PTO return)

Usage:

# Daily briefing (last 24 hours)
/orca-morning-briefing

# Monday morning (last 72 hours)
/orca-morning-briefing 72h

# Weekly review
/orca-morning-briefing week

Drill-down keywords (type after briefing):

alerts         # Full list of new critical/high alerts
escalated      # Alerts that changed severity or reopened
attack paths   # New/worsened attack paths with stories
compliance     # Framework scores, trends, worst accounts
exposure       # Internet-facing assets with critical alerts
crown jewels   # New alerts on crown jewel assets
aging          # Unactioned critical alerts sorted by age
activity       # CDR event volumes, unusual actors
new types      # Alert types seen for the first time
trends         # Week-over-week comparison, top affected assets
full           # All sections expanded (for reports/handoffs)

Example output:

═══════════════════════════════════════════════════════════════════
MORNING BRIEFING — 2026-04-17
Last 24 hours | Account: 123456789012
═══════════════════════════════════════════════════════════════════

PULSE: ⚠ NEEDS ATTENTION — 3 new critical alerts

┌─────────────────────────────────────────────────────────────────┐
│  NEW ALERTS         12 total (3 critical, 4 high, 5 medium)    │
│  ESCALATED          2 alerts changed severity or reopened       │
│  ATTACK PATHS       1 new, 2 worsened                           │
│  COMPLIANCE         PCI DSS dropped 2%                          │
│  EXPOSURE           1 asset newly internet-facing               │
│  CROWN JEWELS       1 new alert on critical asset               │
│  AGING CRITICALS    4 critical alerts open > 7 days             │
│  CDR ACTIVITY       Elevated — 3.2k events (normal: ~1k)       │
└─────────────────────────────────────────────────────────────────┘

TOP PRIORITIES:
  [1] orca-4567890 — Log4j RCE on public bastion (137d open!)
  [2] orca-6789012 — S3 bucket publicly accessible (new today)
  [3] orca-7890123 — SendGrid API key exposed in container
═══════════════════════════════════════════════════════════════════

Full Documentation →

"Tell me everything about this asset in one place."

Full 360° security profile of any cloud asset — all open alerts (grouped by category), attack paths, compliance violations, permissions, network exposure, sensitive data, CDR activity summary, crown jewel status, and linked entities.

Features:

• Complete asset identity — name, type, account, region, IPs, OS, tags, creation date, IaC source
• Risk summary with Orca Score, crown jewel status, and exposure classification
• Alerts grouped by category — vulnerabilities, misconfigurations, malware, sensitive data, anomalies, IAM
• Attack path mapping — kill chains with the asset's role (entry point, pivot, target)
• Compliance framework violations per asset
• Effective permissions analysis (AWS IAM assets) with used vs unused breakdown
• CDR activity summary — 30-day event volumes, top actions, unique actors
• Linked entities — connected roles, instances, buckets, databases, load balancers
• Proactive remediation — suggests the highest-impact fix and offers to generate code in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

Usage:

# Profile an asset by name, ID, or ARN
/orca-asset-profile web-bastion-host
/orca-asset-profile i-1234567890abcdef0

# Or use natural language
tell me about web-bastion-host
asset risk for vm-chain3-1

Drill-down keywords (type after profile):

alerts         # All alerts by category
attack paths   # Kill chains with this asset
compliance     # Framework violations
permissions    # IAM analysis (used vs unused)
exposure       # Network exposure details
activity       # CDR events (last 30 days)
linked         # Connected assets
code origin    # IaC source mapping
full           # All sections expanded

Example output:

═══════════════════════════════════════════════════════════════════
ASSET PROFILE — web-bastion-host
AwsEc2Instance | 123456789012 | us-east-1 | running
═══════════════════════════════════════════════════════════════════

RISK: Orca Score 9.0 (Critical) | Crown Jewel: NO

┌─────────────────────────────────────────────────────────────────┐
│  ALERTS        12 total (3 critical, 4 high, 5 medium)         │
│  ATTACK PATHS  4 active kill chains                             │
│  COMPLIANCE    6 frameworks, 18 failing controls                │
│  EXPOSURE      public_facing | ports: 22, 443                   │
│  SENSITIVE     API keys, credentials                            │
│  PERMISSIONS   overprivileged (via instance profile)            │
│  CDR ACTIVITY  847 events in 30d (elevated)                     │
│  LINKED        9 connected assets                               │
└─────────────────────────────────────────────────────────────────┘

TOP ALERTS:
  [1] orca-4567890 — Log4j RCE (score: 9.0, vulnerability)
  [2] orca-7890123 — SendGrid API key exposed (score: 8.5, sensitive data)
  [3] orca-3456789 — Root account without MFA (score: 8.0, misconfiguration)

RECOMMENDED ACTION:
  The highest-impact fix is orca-4567890 (Log4j RCE on a public
  asset). I can generate remediation code right now.

  What format? terraform | cloudformation | cli | instructions
═══════════════════════════════════════════════════════════════════

Full Documentation →

"Where are we failing, what's the fastest path to improve?"

Deep compliance gap analysis for any framework — failing controls ranked by blast radius, quick wins (single-fix controls), account breakdown, score trends, and a phased remediation plan with projected score improvements.

Features:

• Framework overview with scores, trends, and worst/best identification
• Failing controls ranked by cross-framework impact and asset count
• Quick win detection — single-config fixes that improve multiple frameworks at once
• Account/business unit breakdown — who owns the worst gaps
• 30-day compliance trend analysis — improving, stable, or degrading
• Phased remediation plan — quick wins (days), systematic fixes (weeks), architectural changes (months)
• Projected score improvements per phase
• Proactive remediation — offers to generate fix code for any control in Terraform, CloudFormation, Ansible, CLI, Pulumi, or ARM/Bicep

Usage:

# All frameworks overview
/orca-compliance-gap

# Specific framework deep-dive
/orca-compliance-gap PCI DSS
/orca-compliance-gap CIS AWS

# Or use natural language
how's our PCI compliance?
what's failing in SOC 2?
quick wins for compliance

Drill-down keywords (type after analysis):

controls         # All failing controls ranked by impact
quick wins       # Fastest path to score improvement
accounts         # Gap breakdown by account
trends           # 30-day score history
remediation plan # Phased fix plan with projections
full             # All sections expanded

Example output:

═══════════════════════════════════════════════════════════════════
COMPLIANCE GAP ANALYSIS — All Frameworks
2026-04-17 | All accounts
═══════════════════════════════════════════════════════════════════

POSTURE: Moderate — 3 frameworks below 85% target

┌─────────────────────────────────────────────────────────────────┐
│  FRAMEWORKS     8 enabled                                       │
│  AVG SCORE      84%                                             │
│  WORST          HIPAA at 71%                                    │
│  BEST           CIS AWS at 94%                                  │
│  TREND (30d)    degrading — PCI dropped 2%                      │
│  QUICK WINS     6 controls fixable with single changes          │
│  WORST ACCOUNT  123456789012 — 76% avg score                   │
└─────────────────────────────────────────────────────────────────┘

TOP FAILING CONTROLS (highest impact):
  [1] Enable MFA for root — failing on 3 accounts, affects 5 frameworks
  [2] Encrypt EBS volumes — failing on 12 assets, affects 4 frameworks
  [3] Restrict SSH access — failing on 8 assets, affects 4 frameworks

RECOMMENDED ACTION:
  The fastest score improvement: enable MFA for root —
  affects 3 accounts across 5 frameworks. I can generate the fix.

  What format? terraform | cloudformation | cli | instructions
═══════════════════════════════════════════════════════════════════

Full Documentation →

"Where is our sensitive data, is it protected, and what's at risk?"

DSPM (Data Security Posture Management) view: discovers sensitive data across the environment — secrets, PII, credentials, API keys, fi