Orca Schema

        graph LR
    OrcaOrganization -- RESOURCE --> OrcaAlert
    OrcaOrganization -- RESOURCE --> OrcaVulnerabilityFinding
    

OrcaAlert

A security issue reported and prioritized by Orca.

Ontology Mapping: This node uses the ontology label SecurityIssue.

Properties

Ontology-generated fields are shown in italics.

Field	Index	Description
id	Yes	Stable organization-scoped identifier for the Orca alert.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp when this Orca alert was last seen.
alert_type	Yes	Orca alert type.
category	Yes	Orca alert category.
console_url		URL for the alert in the Orca console.
created_at		Timestamp when Orca created the alert.
cve_ids		CVE identifiers referenced by the alert.
details		Detailed explanation of the security issue from Orca.
last_seen		Timestamp when Orca most recently observed the alert.
orca_id	Yes	Raw Orca AlertId value.
orca_score		Contextual risk score assigned to the alert by Orca.
organization_id	Yes	Identifier of the Orca organization that owns this alert.
severity	Yes	Raw Orca alert severity.
status	Yes	Raw Orca alert workflow status.
target_arn	Yes	Amazon Resource Name associated with the alert target.
target_cloud_account_id	Yes	Provider-native account, subscription, or project identifier associated with the alert target.
target_cloud_provider	Yes	Cloud provider associated with the alert target.
target_name		Display name reported for the alert target.
target_orca_asset_unique_id	Yes	Orca AssetUniqueId associated with the alert target.
target_orca_inventory_id	Yes	Orca inventory identifier associated with the alert target.
target_provider_id	Yes	Provider-native identifier associated with the alert target.
target_region		Cloud region associated with the alert target.
target_type		Orca resource type reported for the alert target.
title		Human-readable Orca alert title.
_ont_first_seen	Yes	Normalized field sourced from created_at.
_ont_severity	Yes	Normalized field sourced from severity.
_ont_source		Module that populated this node’s ontology fields.
_ont_status	Yes	Normalized field sourced from status.
_ont_title	Yes	Normalized field sourced from title.
_ont_type	Yes	Normalized field sourced from alert_type.

Relationships

• (:OrcaOrganization)-[:RESOURCE]->(:OrcaAlert): Links an Orca organization to one of its alerts.

OrcaOrganization

An Orca organization whose security findings are ingested by Cartography.

Ontology Mapping: This node uses the ontology label Tenant.

Properties

Ontology-generated fields are shown in italics.

Field	Index	Description
id	Yes	Stable Orca organization identifier.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp when this Orca organization was last seen.
api_url		Regional Orca API base URL used for this organization.
name		Display name of the Orca organization.
_ont_name	Yes	Normalized field sourced from name.
_ont_source		Module that populated this node’s ontology fields.

Relationships

• (:OrcaOrganization)-[:RESOURCE]->(:OrcaAlert): Links an Orca organization to one of its alerts.

• (:OrcaOrganization)-[:RESOURCE]->(:OrcaVulnerabilityFinding): Links an Orca organization to one of its vulnerability findings.

OrcaVulnerabilityFinding

A CVE occurrence reported by Orca.

Ontology Mapping: This node uses the ontology label CVE.

Properties

Ontology-generated fields are shown in italics.

Field	Index	Description
id	Yes	Stable organization-scoped identifier for the vulnerability occurrence.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp when this Orca vulnerability finding was last seen.
base_score		CVSS base score reported by Orca.
base_severity	Yes	Raw CVSS base severity reported by Orca.
cisa_kev		Whether Orca reports the CVE in the CISA KEV catalog.
cpe	Yes	Common Platform Enumeration identifier for the affected package.
cve_id	Yes	CVE identifier reported by Orca.
cvss_source		Source authority for the CVSS assessment.
description		Description of the vulnerability from Orca.
epss_percentile		EPSS percentile reported by Orca.
epss_probability		EPSS exploitation probability reported by Orca.
first_seen		Timestamp when Orca first observed the vulnerability on the asset.
has_exploit		Whether Orca reports a known exploit for the CVE.
orca_id	Yes	Raw Orca occurrence identifier, when the API supplies one.
organization_id	Yes	Identifier of the Orca organization that owns this vulnerability finding.
package_base_id_uuid		Raw base_id_uuid supplied on the related package object; retained as provenance but not used as package identity.
package_id	Yes	Stable Orca identifier for the installed package, when supplied.
package_name	Yes	Name of the affected installed package.
package_version		Installed version of the affected package.
patch_available		Whether Orca reports that a patch is available.
purl	Yes	Package URL identifying the affected package version.
references		Reference URLs associated with the vulnerability.
source_package		Source package from which the installed package was built.
target_arn	Yes	Amazon Resource Name associated with the vulnerability target.
target_cloud_account_id	Yes	Provider-native account, subscription, or project identifier associated with the vulnerability target.
target_cloud_provider	Yes	Cloud provider associated with the vulnerability target.
target_name		Display name reported for the vulnerability target.
target_orca_asset_unique_id	Yes	Orca AssetUniqueId associated with the vulnerability target.
target_orca_inventory_id	Yes	Orca inventory identifier associated with the vulnerability target.
target_provider_id	Yes	Provider-native identifier associated with the vulnerability target.
target_region		Cloud region associated with the vulnerability target.
target_type		Orca resource type reported for the vulnerability target.
trending		Whether Orca identifies the vulnerability as trending.
upstream_disposition		Upstream package maintainer disposition reported by Orca.
vector_string		CVSS vector string reported by Orca.
_ont_base_score	Yes	Normalized field sourced from base_score.
_ont_base_severity	Yes	Normalized field sourced from base_severity.
_ont_cve_id	Yes	Normalized field sourced from cve_id.
_ont_description		Normalized field sourced from description.
_ont_references		Normalized field sourced from references.
_ont_source		Module that populated this node’s ontology fields.
_ont_vector_string	Yes	Normalized field sourced from vector_string.

Relationships

• (:OrcaOrganization)-[:RESOURCE]->(:OrcaVulnerabilityFinding): Links an Orca organization to one of its vulnerability findings.