orca-asset-profile

Orca Asset Profile Skill

Answers the question: "Tell me everything about this asset in one place."

Given an asset name, ID, or ARN, provides a complete 360° security profile: all open alerts (grouped by category), attack paths, compliance violations, permissions, network exposure, sensitive data, CDR activity summary, crown jewel status, and linked entities.

Usage

/orca-asset-profile web-bastion-host
/orca-asset-profile i-1234567890abcdef0
/orca-asset-profile arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0

Or natural language:

• "tell me about web-bastion-host"
• "profile CI-SERVER-01-PRD"
• "asset risk for vm-chain3-1"
• "what do we know about this instance?"

Processing Logic

Step 1: Find the Asset

Determine the input type and use the appropriate tool:

Input Pattern	Tool	Parameter
orca-XXXX (alert ID)	get_asset_by_alert_id	alert_id
UUID format	get_asset_by_id	asset_id
vm_XXXX, AwsXXX_XXXX (asset_unique_id)	get_asset_by_id	asset_id + model_type
ARN format arn:aws:...	get_asset_by_id or discovery_search	varies
Name (anything else)	get_asset_by_name	asset_name

If get_asset_by_name returns multiple results, show the list and ask the user to pick.

Step 2: Gather All Data (run ALL in parallel)

Once the asset is identified, extract its UUID (Inventory.id or id), asset_unique_id, group_unique_id, and ARN, then run all queries simultaneously:

Query 1: Full asset details

get_asset_by_id:
  asset_id: <asset_unique_id or group_unique_id>
  model_type: <asset type e.g. "AwsEc2Instance">

Query 2: All alerts on asset

get_asset_related_alerts_summary:
  asset_id: <UUID>

Query 3: Alert count by severity

get_asset_alerts_count_grouped_by_risk_level:
  asset_id: <UUID>

Query 4: Attack paths

get_asset_related_attack_paths_summary:
  asset_id: <UUID>

Query 5: Crown jewel status

get_asset_crown_jewel_info:
  group_unique_id: <group_unique_id>