orca-cve-blast-radius

Orca CVE Blast-Radius Skill

Answers the question: "This CVE just dropped — which of our assets are actually at risk, ranked by real exposure?"

Static CVSS doesn't tell you which workloads matter. This skill takes a CVE-ID, finds every affected asset across all accounts, and ranks them by runtime exposure context — internet-facing, attack-path participation, crown jewel status, and existing related alerts.

Usage

/orca-cve-blast-radius CVE-2021-44228
/orca-cve-blast-radius CVE-2024-1234
/orca-cve-blast-radius CVE-2024-3094 prod

Or natural language:

• "blast radius of CVE-2024-1234"
• "where are we affected by Log4Shell?"
• "which assets have CVE-2021-44228?"
• "show me CVE-2024-3094 across all accounts"

Processing Logic

Step 1: Parse the CVE-ID

Extract a single CVE-ID in CVE-YYYY-NNNNN form. If the user provided a name (e.g. "Log4Shell", "xz backdoor", "Spring4Shell"), map to the canonical CVE-ID first using a discovery_search query like "<name> CVE". If the mapping is ambiguous, list candidates and ask the user to pick.

Optional scope arg: prod, staging, account <id>. Default: all accounts.

Step 2: Find every affected asset (parallel)

Run all three queries in parallel:

Query 1: Asset hits by CVE-ID

discovery_search:
  search_phrase: "assets with <CVE-ID>"
  limit: 50

Query 2: Critical exposure hits

discovery_search:
  search_phrase: "internet facing assets with <CVE-ID>"
  limit: 50

Query 3: Active alert hits (catches assets where Orca raised the CVE as an alert)

discovery_search:
  search_phrase: "open alerts for <CVE-ID>"
  limit: 50

De-duplicate by asset_id / group_unique_id after the three queries return. The intersection (assets in all three sets) is the highest priority.

Step 3: Enrich top affected assets (parallel)

Take the top 10 affected assets (prioritized by: internet-facing first → then by alert count → then by asset name). Per asset, in parallel:

get_asset_by_id:
  asset_id: <UUID>

get_asset_related_alerts_summary:
  asset_id: <UUID>

get_asset_related_attack_paths_summary:
  asset_id: <UUID>

get_asset_crown_jewel_info:
  group_unique_id: <group_unique_id>