[INTPLAT-462] DDS: Orca Security: integration V1.0.0

.github/workflows/config/labeler.yml

@@ -407,6 +407,8 @@ integration/openstack_controller:
 - openstack_controller/**/*
 integration/oracle:
 - oracle/**/*
+integration/orca_security:
+- orca_security/**/*
 integration/ossec_security:
 - ossec_security/**/*
 integration/otel:

orca_security/CHANGELOG.md

@@ -0,0 +1,7 @@
+# CHANGELOG - orca_security
+
+## 1.0.0 / 2024-11-29
+
+***Added***:
+
+* Initial Release

orca_security/README.md

@@ -0,0 +1,58 @@
+# Orca Security Integration For Datadog
+
+## Overview
+
+[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.
+This integration ingests the following log:
+
+- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.
+
+The Orca Security integration seamlessly ingests the data of alert logs using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format, and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.
+
+## Setup
+
+### Configuration
+
+#### [Orca Security Configuration for Datadog][2]
+
+1. Login to the Orca Security Platform.
+2. Go to **Settings** > **Connections** > **Integrations**.
+3. In the **SIEM/SOAR** section, select **Datadog**, and then click **Connect**.
+
+   The Datadog Configuration window opens.
+4. Specify the following settings:
+   - **API Key** - Add the API key of your Datadog platform.
+   - **Region** - Select the region where your Datadog instance is located.
+5. Click **Save**.
+6. Click **Configure** on the Datadog Integration and enable the integration.
+7. Go to **Automations** and click **+ Create Automation**.
+8. In the **Automation Details** section, provide **Automation Name**.
+9. In the **Trigger Query** section, select all the values for alert state in the query. The query should look as below:
+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.  
+**Note**: Alerts that were updated more than 18 hours ago cannot be ingested into Datadog.
+11. In the **SIEM/SOAR** section under the **Define Results** section, check **Datadog** and select **Logs** as the Datadog type.
+12. Click **Create**.
+
+## Data Collected
+
+### Logs
+
+The Orca integration collects and forwards Orca alert logs to Datadog.
+
+### Metrics
+
+The Orca integration does not include any metrics.
+
+### Events
+
+The Orca integration does not include any events.
+
+## Support
+
+For further assistance, contact [Datadog Support][3].
+
+[1]: https://docs.orcasecurity.io/docs
+[2]: https://docs.orcasecurity.io/docs/integrating-datadog
+[3]: https://docs.datadoghq.com/help/