ORCA
Discover shadow APIs before attackers do
13 followers
Discover shadow APIs before attackers do
13 followers
API security without agents, code changes, or cloud proxies. ORCA passively observes traffic from a network mirror - discovering shadow APIs, mapping every endpoint and consumer, and catching DNS exfiltration, fully on-premises, zero latency. If you can configure a mirror port, you're done.
This is the 2nd launch from ORCA. View more
Orca V1.1 Auto API Docs by Frequency
Launched this week
Orca watches your live API traffic and auto-generates documentation ranked by real usage - so your busiest endpoints get documented first, and nothing you actually ship goes undocumented.
Free Options
Launch Team
honestly this looks really clean for teams that don't want to touch production code. one thing though - would be great if you could plug in threat intel feeds directly so the DNS exfiltration detection can flag known bad domains out of the box instead of just catching the pattern
@rabiasa3v Thanks Rabia! Threat intel feed integration is on the roadmap and fits cleanly - since everything runs on-prem, we can match against known-bad indicators (domains, IPs, JA3/JA4) locally without calling out to a third-party cloud, which the banks and gov clients need anyway.
Appreciate the suggestion - abuse.ch (URLhaus/ThreatFox) is exactly the kind of feed that fits this model, so it's going on the shortlist.
The mirror port approach is clever for avoiding deployment headaches. One thing that would make this even more useful for us is a visual diff between API versions, so we can quickly see when a new endpoint pops up or an existing one's behavior changes, instead of just getting a flat list of what's currently running.
@remzi698130 @remzi698130 Love this - it's the natural payoff of docs from traffic instead of code. We can snapshot specs over time and diff them: new endpoints appearing, ones going silent, behavioral drift on existing ones (new param, changed response shape, an auth check quietly dropping). And since it's frequency-ranked, we can flag significance - a new endpoint taking thousands of calls/day matters more than one hit twice in staging.
Definitely going on the roadmap. I'm leaning toward a passive view you check rather than pushing everything to alerts - keeps it from getting noisy. Though one idea I like: let you set a frequency threshold, so only changes above a certain traffic level push to Slack/webhook, and everything else just sits in the passive view.