Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=Orca

Orca Security

API

You must have the Public Cloud integrations license pack to use this feature.

You can integrate Orca with Sophos Central so that it sends data to Sophos for analysis.

This is an API integration. You need an API key, also known as an API token, from Orca.

The key steps are as follows:

  • Get an API key and base URL from Orca.
  • Configure an integration in Sophos Central.

Get an API key and base URL

To get the API key and base URL, do as follows:

  1. Sign in to Orca as an administrator with the same rights that are needed to perform the API's actions.

    The API key inherits its user role and permissions from the signed-in admin.

  2. In the Orca dashboard, go to Settings > Modules.

  3. Select the Integrations tab.
  4. Click Generate Key.
  5. Copy and save the key.
  6. In the Swagger tile, click View.
  7. Make a note of the Base URL at the top of the page. For example: app.us.orcasecurity.io.

Configure an integration

To integrate Orca with Sophos Central, do as follows:

  1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

  2. Click Orca.

    The Orca page opens. You can configure integrations here and see a list of any you've already configured.

  3. In Data Ingest (Security Alerts), click Add Configuration.

    Note

    If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See My domains and IPs.

  4. In Integration steps, do as follows:

    1. Enter a name and a description for the integration.

    2. Enter the Base URL you looked up earlier.

      Prefix the URL with https://. For example: https://app.us.orcasecurity.io.

    3. Enter the API token.

  5. Click Save

We create the integration and it appears in your list. If the status icon shows Healthy, your data should appear in the Sophos Data Lake after validation.

More information