Orca Security Alerts (via Microsoft Entra ID)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | OrcaSecurityAlertsCCF |
| Publisher | Orca Security |
| Used in Solutions | Orca Security Alerts |
| Collection Method | CCF Push |
| Connector Definition Files | OrcaSecurityAlerts_ConnectorDefinition.json |
| DCR Definition Files | OrcaSecurityAlerts_DCR.json |
| CCF Configuration | OrcaSecurityAlerts_PollerConfig.json |
| CCF Capabilities | Push |
| Ingestion API | Log Ingestion API — CCF Push connectors use DCR-based Log Ingestion API |
| Microsoft Learn | View on Learn |
The Orca Security Alerts connector lets you stream Orca cloud security alerts into Microsoft Sentinel. Orca pushes alerts to the Logs Ingestion API of a Data Collection Endpoint using a Microsoft Entra ID application, replacing the legacy Log Analytics Shared Key authentication.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
OrcaAlerts_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): read and write permissions are required.
Custom Permissions:
- Microsoft Entra ID: Permission to create an app registration in Microsoft Entra ID (if using the auto-created app). Typically requires the Application Developer role or higher.
- Microsoft Azure: Permission to create and configure Azure resources (DCE, DCR, table) and assign RBAC roles. Typically requires the Contributor and User Access Administrator roles.
- Orca Security: Access to the Orca Security platform to configure the Microsoft Sentinel integration.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Deploy connector resources
Deploy the Azure resources required to ingest Orca Security alerts via the Logs Ingestion API using Microsoft Entra ID authentication.
Choose your deployment option
Option A: Auto-create a Microsoft Entra application (Recommended)
Clicking Deploy Orca Security Alerts Connector automatically creates:
- A Data Collection Endpoint (DCE)
- A Data Collection Rule (DCR) with the Orca alerts stream
- The Log Analytics table (OrcaAlerts_CL)
- A Microsoft Entra application with a client secret
- The role assignment (Monitoring Metrics Publisher) on the DCR
After deployment: the Tenant ID, Client ID, Client Secret, DCE URI and DCR Immutable ID are auto-populated below for copy-paste into the Orca platform.
Option B: Use a pre-existing Microsoft Entra application (BYOA)
Clicking Deploy Orca Security Alerts Connector creates the DCE, DCR and table, plus an Entra application you can ignore.
Additional steps required:
- Assign your existing Entra application's service principal the Monitoring Metrics Publisher role on the created DCR.
- Use your own application's Client ID and Client Secret (ignore the auto-generated ones below).
- Use the DCE URI, DCR Immutable ID and Stream Name from below.
Click Deploy to begin: Deploy Orca Security Alerts Connector
2. Configure the Orca Security integration
Copy the following values into the Microsoft Sentinel integration settings in the Orca Security platform. For Option A (auto-created app): use all the auto-populated values below.
For Option B (pre-existing app): use the DCE URI, DCR Immutable ID and Stream Name below, but use your own application's Tenant ID, Client ID and Client Secret.
Azure configuration values:
- Tenant ID:
TenantIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Application (Client) ID:
ApplicationIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Client Secret:
ApplicationSecretNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Data Collection Endpoint (DCE) URI:
DataCollectionEndpointNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Data Collection Rule (DCR) Immutable ID:
DataCollectionRuleIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Stream Name:
Custom-OrcaSecurityAlerts
Configure in the Orca Security platform
- Log in to your Orca Security console.
- Navigate to Settings > Integrations > Microsoft Sentinel.
- Paste the configuration values from above (Tenant ID, Application (Client) ID, Client Secret, DCE URI, DCR Immutable ID and Stream Name).
- Click Save to complete the integration.
3. Verify data ingestion
Confirm that alerts are flowing from Orca Security into Microsoft Sentinel.
Verification steps
- Trigger or wait for an alert in Orca Security.
- Wait 5-10 minutes for the data to appear in Microsoft Sentinel.
- Run the following query to verify alerts:
OrcaAlerts_CL
| take 10
- Check connectivity:
OrcaAlerts_CL
| summarize LastLogReceived = max(TimeGenerated)
| project IsConnected = LastLogReceived > ago(30d)
If data appears and IsConnected returns true, the connector is configured correctly.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊