orca-custom-framework

Orca Custom Framework Skill

Answers the question: "How do I create a custom compliance framework tailored to my organization's specific security requirements?"

Given a source (existing framework, list of alert IDs, or a security theme), this skill gathers relevant controls and alerts, organizes them into a structured custom compliance framework with logical sections, and creates it in Orca Security. When gaps exist — controls the user wants but Orca doesn't have a built-in rule for — the skill suggests creating custom discovery alerts to fill them.

Usage

/orca-custom-framework Supply Chain Security Controls
/orca-custom-framework from:cis_docker_v.1.3.1
/orca-custom-framework alerts:orca-1234,orca-5678,orca-9012
/orca-custom-framework "Zero Trust Architecture"

Or natural language:

• "create a custom compliance framework for supply chain security"
• "build a framework based on CIS Docker + EKS controls"
• "generate a custom framework from these alerts: orca-1234, orca-5678"
• "create a supply chain security framework"
• "build custom compliance from our failing container controls"

How It Works

The skill operates in three phases, using different tools at each stage:

Phase 1: Read (Orca MCP tools — read-only)

Queries the Orca environment to gather existing controls and alerts:

• get_enabled_compliance_frameworks — lists all frameworks and their IDs
• get_compliance_framework_control_tests — pulls controls from relevant source frameworks, each containing a rule_id
• discovery_search — finds alerts matching the theme (e.g., "container registry", "image scanning")
• get_alert — gets full alert details when working from alert IDs

These are read-only MCP queries. They provide the rule_id values needed for the framework.

Phase 2: Organize (Claude logic — no API calls)

Groups the gathered rule_id values into logical sections based on alert categories, asset types, and the requested theme. Assigns priority weights (high/medium/low) and dotted-notation IDs (e.g., 1.1, 2.3).