orca-investigate

Orca Investigate Skill

Answers the question: "What happened, who did it, and how far did they get?"

Given an actor (IAM identity), source IP, target resource, or suspicious event, traces activity through Orca CDR (CloudTrail/audit logs), builds a session timeline, maps actions to MITRE ATT&CK techniques, clusters related sessions, and assesses the blast radius.

Usage

/orca-investigate arn:aws:iam::123456789012:role/bastion-admin-role
/orca-investigate 10.0.1.50
/orca-investigate account 123456789012

Or natural language:

• "investigate what this role did in the last 24 hours"
• "trace activity from IP 10.0.1.50"
• "what happened in this account today?"
• "investigate suspicious AssumeRole events"
• "who accessed the prod database?"
• "incident investigation for orca-3636513"

Processing Logic

Step 1: Determine Investigation Scope

Parse user input to determine the investigation axis:

Input Pattern	Primary Filter	CDR Parameter
ARN (actor)	Identity-based	actors: ["<ARN>"]
IP address	Source-based	source_ip_addresses: ["<IP>"]
Resource ARN/name	Target-based	targets: ["<resource>"]
Account ID	Account-wide	accounts: ["<account>"]
Event/action name	Action-based	actions: ["<action>"]
Alert ID (orca-XXXX)	Alert-initiated	Fetch alert, extract actor/target, then CDR
Service name	Service-based	services: ["<service>"]

Determine time range:

• Default: "last_24_hours" for active incidents
• "last 3 days" / "last week" → "last_3_days" / "last_7_days"
• User-specified → map to nearest CDR enum

Step 2: Gather Data (run ALL in parallel)

Query 1: Events by the actor/from the source/on the target

search_cdr_events:
  <primary filter>: [<value>]
  time_range: "<selected range>"
  limit: 100

Query 2: Event summary grouped by action

get_cdr_events_grouped_by_event_name:
  <primary filter>: [<value>]
  time_range: "<selected range>"
  page_size: 100