↳ GitHub sourceConnector

Orca Security Alerts (via Microsoft Entra ID)

Description

The [Orca Security](https://orca.security/) Alerts connector lets you stream Orca cloud security alerts into Microsoft Sentinel. Orca pushes alerts to the Logs Ingestion API of a Data Collection Endpoint using a Microsoft Entra ID application, replacing the legacy Log Analytics Shared Key authentication.

Declared status: 1
Declared author / publisher: Orca Security

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

OrcaAlerts_CL

Declared permissions

read and write permissions are required.

Workspace

Workspace

Microsoft Entra ID

Permission to create an app registration in Microsoft Entra ID (if using the auto-created app). Typically requires the Application Developer role or higher.

Microsoft Azure

Permission to create and configure Azure resources (DCE, DCR, table) and assign RBAC roles. Typically requires the Contributor and User Access Administrator roles.

Orca Security

Access to the Orca Security platform to configure the Microsoft Sentinel integration.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

1. Deploy connector resources

Deploy the Azure resources required to ingest Orca Security alerts via the Logs Ingestion API using Microsoft Entra ID authentication.

Deploy Orca Security Alerts Connector

2. Configure the Orca Security integration

Copy the following values into the Microsoft Sentinel integration settings in the Orca Security platform.

Tenant ID

Application (Client) ID

Client Secret

Data Collection Endpoint (DCE) URI

Data Collection Rule (DCR) Immutable ID

Stream Name

3. Verify data ingestion

Confirm that alerts are flowing from Orca Security into Microsoft Sentinel.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Orca Security Alerts/Data Connectors/OrcaSecurityAlertsCCF/OrcaSecurityAlerts_ConnectorDefinition.json ↗
Commit: 629d1d3 ↗
Source identifier: OrcaSecurityAlertsCCF

Additional source files 2

Solutions/Orca Security Alerts/Data Connectors/OrcaSecurityAlertsCCF/OrcaSecurityAlerts_ConnectorDefinition.jsonsource ↗Solutions/Orca Security Alerts/Data/Solution_Orca Security Alerts.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.