Detection rules › Panther

Panther rules: orca

Rule	Severity
Orca Passthrough	`medium`

Orca Passthrough

This is a third-party alert feed, not a detection over modeled telemetry. Another security product raised the finding; this rule forwards or reshapes it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Severity: medium
Entities: aws_account_ids, domain_names, ip_addresses
Log types: Orca.Alert
Tags: Orca, Passthrough
Reference: docs.orcasecurity.io
Source: github.com/panther-labs/panther-analysis

Re-raise Orca alerts in Panther

Detection logic

from panther_core import PantherEvent


def rule(event) -> bool:
    return event.deep_get("state", "status") == "open"


def title(event: PantherEvent) -> str:
    alert_type = event.get("asset_type_string")
    # Use the first non-null field for the title of the alert
    alert_desc = (
        event.deep_get("data", "title") or event.get("type_string") or "<UNKNOWN ALERT TITLE>"
    )
    return f"{alert_type}: {alert_desc}" if alert_type else alert_desc


def description(event):
    return event.get("description") or "DEFAULT"


def dedup(event: PantherEvent) -> str:
    # Explicitly dedup on severity
    return f"({severity(event)}) {title(event)}"


def severity(event: PantherEvent) -> str:
    match event.deep_get("state", "risk_level", default="medium"):
        case "informational":
            return "INFO"
        case "low":
            return "LOW"
        case "medium":
            return "MEDIUM"
        case "high":
            return "HIGH"
        case "critical":
            return "CRITICAL"
        case _:
            return "DEFAULT"


def alert_context(event: PantherEvent) -> dict:
    return {
        "asset": {
            "name": event.get("asset_name", "<UNKNOWN ASSET NAME>"),
            "type": event.get("asset_type", "<UNKNOWN TYPE>"),
            "category": event.get("asset_category", "<UNKNOWN CATEGORY>"),
        },
        "category": event.get("category", "<UNKNOWN CATEGORY>"),
        "cloud_provider": {
            "id": event.get("cloud_provider_id", "<UNKNOWN_CLOUD_PROVIDER_ID>"),
            "type": event.get("cloud_provider", "<UNKNOWN_CLOUD_PROVIDER>"),
        },
        "details": event.deep_get("data", "details", default=""),
        "orca_alert_id": event.deep_get("state", "alert_id", default="<UNKNOWN ALERT ID>"),
        "org_id": event.get("organization_id", "<UNKNOWN ORG ID>"),
    }


def runbook(event: PantherEvent) -> dict:
    return event.get("recommendation") or event.deep_get("data", "recommendation", default="")

Rule specification

AnalysisType: rule
Filename: orca_passthrough.py
RuleID: "Orca.Passthrough"
DisplayName: Orca Passthrough
Enabled: true
LogTypes:
  - Orca.Alert
Severity: Medium
Description: >
  Re-raise Orca alerts in Panther
DedupPeriodMinutes: 1440
Reference: >
  https://docs.orcasecurity.io/docs/alerts
SummaryAttributes:
  - alert_labels
  - asset_name
  - state:alert_id
Tags:
  - Orca
  - Passthrough

Stages and Predicates

Fires on Orca.Alert events when the condition below holds.

Condition

state.status is open

Alert deduplication: repeat matches within 1d group into one alert

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`state.status`	eq	`open`	`field:"state.status" kind:eq value:"open"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`category`
`details`	`data.details`
`orca_alert_id`	`state.alert_id`
`org_id`	`organization_id`
`asset_type_string`
`title`	`data.title`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "account_name": "org-name/repo-name (Project: org-name/repo-name)",
  "alert_labels": [
    "CWE-327",
    "shiftleft:sast",
    "shiftleft:sast:lang:java",
    "source:shiftleft"
  ],
  "alert_source": "Orca Scan",
  "asset_category": "CI Source",
  "asset_name": "org-name/repo-name",
  "asset_state": "enabled",
  "asset_type": "cisource",
  "asset_type_string": "CodeRepository",
  "asset_unique_id": "CodeRepository_32fe97a4-ec58-4823-9521-b226fd4f51a7_e739eb76-0ae6-624a-6479-d00bc1fe37c1",
  "category": "Best practices",
  "cloud_account_id": "fd01de1b-e355-4d9c-8a0f-142dee95ae6f",
  "cloud_account_type": "Regular",
  "cloud_provider": "shiftleft",
  "cloud_provider_id": "32fe97a4-ec58-4823-9521-b226fd4f51a7",
  "cloud_vendor_id": "32fe97a4-ec58-4823-9521-b226fd4f51a7",
  "cluster_name": "org-name/repo-name",
  "cluster_type": "cisource",
  "cluster_unique_id": "CodeRepository_32fe97a4-ec58-4823-9521-b226fd4f51a7_e739eb76-0ae6-624a-6479-d00bc1fe37c1",
  "configuration": {},
  "container_id": "coderepository-a026f1a3-7ad4-492f-a9ef-b4213f05eba2-fcd577d6-99d4-4489-9f24-03b45bb6a43c",
  "context": "data",
  "description": "The rule detects the use of weak hash algorithms that are vulnerable to hash collisions. Using these algorithms can lead to security risks, including data integrity issues. It is crucial to adopt stronger hash functions to maintain secure cryptographic practices.",
  "details": "The rule detects the use of weak hash algorithms that are vulnerable to hash collisions. Using these algorithms can lead to security risks, including data integrity issues. It is crucial to adopt stronger hash functions to maintain secure cryptographic practices.",
  "group_name": "org-name/repo-name",
  "group_type": "cisource",
  "group_type_string": "NonGroup",
  "group_unique_id": "CodeRepository_32fe97a4-ec58-4823-9521-b226fd4f51a7_e739eb76-0ae6-624a-6479-d00bc1fe37c1",
  "group_val": "nongroup",
  "is_compliance": false,
  "level": 0,
  "organization_id": "5f1c59f5-7c6c-4a56-a6ff-94998abdf9c3",
  "organization_name": "Partners",
  "p_event_time": "2025-03-13 07:37:05.000000000",
  "p_log_type": "Orca.Alert",
  "p_parse_time": "2025-03-13 07:45:02.263118919",
  "p_row_id": "2adeaf6dac909095c0feb0a525b6d902",
  "p_schema_version": 0,
  "p_source_id": "d0904c6a-e437-4082-8807-6bdccc0fc16f",
  "p_source_label": "Orca Prod",
  "recommendation": "Replace weak hash algorithms with stronger alternatives such as SHA-256 or SHA-3 to prevent vulnerabilities related to hash collisions and enhance security.",
  "rule_id": "rc72e2d8cf8",
  "source": "src/main/java/org/owasp/webgoat/lessons/cryptography/HashingAssignment.java:55",
  "state": {
    "alert_id": "orca-123456",
    "created_at": "2025-03-13 07:37:05.000000000",
    "high_since": "2025-03-13 07:38:34.000000000",
    "in_verification": false,
    "last_seen": "2025-03-13 07:37:05.000000000",
    "last_updated": "2025-03-13 07:37:05.000000000",
    "orca_score": 5.8,
    "risk_level": "medium",
    "rule_source": "Orca",
    "score": 3,
    "severity": "hazardous",
    "status": "open",
    "status_time": "2025-03-13 07:37:05.000000000"
  },
  "subject_type": "CodeRepository_32fe97a4-ec58-4823-9521-b226fd4f51a7_e739eb76-0ae6-624a-6479-d00bc1fe37c1",
  "type": "shiftleft_96f8e29d-f941-5559-96e8-0ada0431b3a1",
  "type_key": "6d9583cc014beabccfe02c0debb64a28b9d73cc4ef87079fdfb2e23b2d9d8c8d6843e21a79f0059d62eadcef5fb5af0da3ad72c7406d688c544d51af6e62396d_0",
  "type_string": "Use of Weak Hash Algorithms in Cryptography"
}