Orca Security Alerts

The Orca Security parser for DefectDojo supports imports from CSV and JSON formats. This document details the parsing of Orca Security alert exports into DefectDojo field mappings and unmapped fields.

Supported File Types

The Orca Security parser accepts CSV and JSON file formats. To generate these files from Orca Security:

1. Log into the Orca Security console
2. Navigate to the Alerts page
3. Apply desired filters (scope, severity, status)
4. Click “Export” and select either CSV or JSON format
5. Save the exported file
6. Upload to DefectDojo using the “Orca Security Alerts” scan type

The parser auto-detects the format: files starting with [ are treated as JSON, otherwise CSV.

Default Deduplication Hashcode Fields

By default, DefectDojo identifies duplicate Findings using the hashcode deduplication algorithm with the following fields:

• title
• component_name

Sample Scan Data

Sample Orca Security scans can be found in the sample scan data folder.

Link To Tool

• Orca Security
• Orca Security Documentation

CSV Format

Total Fields in CSV

• Total data fields: 12
• Total data fields parsed: 12
• Total data fields NOT parsed: 0

CSV Format Field Mapping Details

Additional Finding Field Settings (CSV Format)

JSON Format

Total Fields in JSON

• Total data fields: 10
• Total data fields parsed: 10
• Total data fields NOT parsed: 0

JSON Format Field Mapping Details

Additional Finding Field Settings (JSON Format)

Special Processing Notes

Date Processing

The parser uses dateutil.parser.parse() to handle ISO 8601 date formats from Orca Security exports. The datetime is converted to a date object using .date(). Invalid or missing date strings return None.

Severity Conversion

OrcaScore (float 0-10) is converted to DefectDojo severity levels:

• 0 or missing → Info
• 0.1 - 3.9 → Low
• 4.0 - 6.9 → Medium
• 7.0 - 8.9 → High
• 9.0 - 10.0 → Critical

The conversion uses float() with error handling — non-numeric values default to Info severity.

Severity Justification

The OrcaScore is also stored in the severity_justification field as “OrcaScore: X.X”. This preserves the original numeric score for reference while the severity field contains the mapped categorical value.

Description Construction

The parser builds a structured markdown description from all available alert fields. Each field is formatted as a bold label followed by its value, separated by double newlines. Fields with empty values are omitted. The description includes: Title, Category, Source, Inventory name, Cloud Account name, Orca Score, Status, Created date, Last Seen date, and Labels.

Title Format

Finding titles use the alert’s Title field directly. Titles longer than 500 characters are truncated with a “…” suffix. Alerts with no title receive the default “Orca Security Alert”.

Service Field

The Source field from Orca Security populates the DefectDojo service field. This represents the cloud resource or service that generated the alert.

Mitigation Construction

Orca Security CSV and JSON exports do not include remediation or mitigation text. The mitigation field is not populated by this parser.

Deduplication

Deduplication uses the hashcode algorithm configured in settings.dist.py with the fields title and component_name. This ensures findings with the same alert title on the same resource are deduplicated across reimports. Each row/item in the export becomes one Finding with no internal deduplication.

Tags Handling

Labels from Orca Security are stored as finding tags using the unsaved_tags field. This makes labels searchable and filterable in DefectDojo. In CSV format, the Labels column contains a JSON-encoded array of strings. The parser uses json.loads() to parse this embedded JSON. If parsing fails, the raw string is used as a single tag. In JSON format, Labels is a native array of strings.