From Orca Skills
Creates custom compliance frameworks from existing frameworks, alert lists, or security themes, organizes controls into sections, maps alerts, and pushes the framework to Orca. Suggests custom discovery alerts for gaps.
How this skill is triggered — by the user, by Claude, or both
Slash command
/orca-skills:orca-custom-frameworkThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Answers the question: **"How do I create a custom compliance framework tailored to my organization's specific security requirements?"**
Answers the question: "How do I create a custom compliance framework tailored to my organization's specific security requirements?"
Given a source (existing framework, list of alert IDs, or a security theme), this skill gathers relevant controls and alerts, organizes them into a structured custom compliance framework with logical sections, and creates it in Orca Security. When gaps exist — controls the user wants but Orca doesn't have a built-in rule for — the skill suggests creating custom discovery alerts to fill them.
/orca-custom-framework Supply Chain Security Controls
/orca-custom-framework from:cis_docker_v.1.3.1
/orca-custom-framework alerts:orca-1234,orca-5678,orca-9012
/orca-custom-framework "Zero Trust Architecture"
Or natural language:
The skill operates in three phases, using different tools at each stage:
Queries the Orca environment to gather existing controls and alerts:
get_enabled_compliance_frameworks — lists all frameworks and their IDsget_compliance_framework_control_tests — pulls controls from relevant source frameworks, each containing a rule_iddiscovery_search — finds alerts matching the theme (e.g., "container registry", "image scanning")get_alert — gets full alert details when working from alert IDsThese are read-only MCP queries. They provide the rule_id values needed for the framework.
Groups the gathered rule_id values into logical sections based on alert categories, asset types, and the requested theme. Assigns priority weights (high/medium/low) and dotted-notation IDs (e.g., 1.1, 2.3).
Also identifies gaps — security domains the user wants covered but where no existing Orca rule exists. For these, suggests creating custom discovery alerts (see Step 7).
There is no MCP tool for creating custom frameworks. The skill calls the Orca REST API directly:
POST https://api.orcasecurity.io/api/compliance/frameworks
Authorization: <token from .mcp.json>
The token is extracted from .mcp.json (orca-security.headers.Authorization).
Parse user input to determine the source:
Query 1-5: Discovery searches with different angles
discovery_search:
search_phrase: "<theme> security alerts"
limit: 10
Run 5+ searches with different angle terms simultaneously to maximize coverage. Vary the search terms across the theme's domains (infrastructure, IAM, data, network, logging).
Query 6: All enabled frameworks
get_enabled_compliance_frameworks:
(no filters)
Query 7+: Control tests from relevant frameworks For each framework that relates to the theme, pull all controls:
get_compliance_framework_control_tests:
framework_id: <id>
Identify which existing frameworks are most relevant to the theme and pull their controls. For example, a container-focused theme would query cis_docker_v.1.3.1 and cis_eks_1.5.0, while an IAM-focused theme would query aws_cis_6.0.0 and orca_best_practices_2.0.0.
get_enabled_compliance_frameworks → get framework IDs
get_compliance_framework_control_tests → pull source controls
get_framework_assets_with_failed_controls_count → context on impact
get_alert → for each alert ID, extract rule_id and metadata
get_enabled_compliance_frameworks → for cross-referencing
CRITICAL: The Orca custom framework API requires rule_id values (internal Orca rule identifiers like r40aa617ef4), NOT alert IDs. Extract rule_ids from:
get_compliance_framework_control_tests has a rule_id field — use these directly. This is the primary and most reliable method.RuleId field in its data — query with get_alert and extract it.Group controls into logical sections using alert categories, asset types, and domain keywords. Adapt sections to the user's theme — the section names, groupings, and keyword mappings should all reflect what the user asked for.
Default section taxonomy (adapt based on theme):
| Section | Maps to Alert Categories | Example Controls |
|---|---|---|
| Identity & Access Management | IAM, permissions, roles, service accounts | Least-privilege, MFA enforcement, key rotation |
| Compute Security | VMs, instances, containers, serverless | Instance hardening, patching, secure boot |
| Network Security | VPC, firewalls, endpoints, load balancers | Network segmentation, TLS enforcement, ingress rules |
| Data Protection | Storage, databases, encryption, secrets | Encryption at rest, key management, data classification |
| Logging & Monitoring | Audit logs, alerts, metrics | Audit trail completeness, log retention |
| Vulnerability Management | CVEs, packages, images | Patch management, image scanning, dependency updates |
| Configuration Management | Misconfigurations, best practices | Secure defaults, hardened configurations |
Use the alert category, description, and asset_types fields from control tests to assign each rule_id to the appropriate section. When the user's theme implies specialized sections (e.g., "Container Image Security" for supply chain, "Training Infrastructure" for AI/ML), create those instead of the generic defaults.
ALWAYS show a preview before creating. Display the framework structure, control counts, priority breakdown, and source frameworks.
Only proceed after user confirms the preview.
Create: POST /api/compliance/frameworks
Update: PUT /api/compliance/frameworks/{id}
Delete: DELETE /api/compliance/frameworks/{id}
{
"name": "<framework_name>",
"description": "<framework_description>",
"checkedKeys": [],
"sections": [
{
"name": "1. <Section Name>",
"section_id_in_framework": "1",
"tests": [
{
"rule_id": "<orca_rule_id>",
"rule_id_in_framework": "1.1",
"reference_id": "1.1",
"origin_framework_id": "<source_framework_id>",
"priority": "high"
}
],
"sections": []
}
]
}
Field reference:
rule_id (required) — Orca internal rule ID, NOT an alert IDrule_id_in_framework (required) — Dotted control number (e.g., "1.1", "3.4")reference_id (optional) — Typically same as rule_id_in_frameworkorigin_framework_id (optional) — Source framework ID for traceabilitypriority (optional) — "high" / "medium" / "low" — affects framework scoring weightsection_id_in_framework (optional) — Dotted section numbersections can be nested recursively for hierarchical frameworkscheckedKeys — pass [] for API-created frameworkscurl -X POST "https://api.orcasecurity.io/api/compliance/frameworks" \
-H "Authorization: <token>" \
-H "Content-Type: application/json" \
-d '<json_body>'
Response: {"data": {"id": <framework_id>, "name": "<framework_name>", ...}}
"high" priority controls impact the overall score more heavily.mcp.json (orca-security.headers.Authorization)Query get_enabled_compliance_frameworks to verify the framework appears. Show the user:
/orca-compliance-gap <framework_name>After organizing controls, identify security domains the user wants covered but where no existing Orca rule exists. For these gaps, suggest creating custom discovery alerts.
rule_id was found in any frameworkPresent the gap and offer to create a custom discovery alert:
GAP DETECTED: No existing Orca rule for "SBOM generation validation"
You can fill this gap by creating a custom discovery alert:
POST /api/sonar/rules
{
"name": "Container image deployed without SBOM attestation",
"details": "Detects container images in production registries that lack
an associated SBOM attestation or provenance record.",
"category": "Best practices",
"orca_score": 6.0,
"context_score": false,
"rule_json": {
"models": ["ContainerImage"],
"type": "object_set",
"with": { ... discovery query ... }
},
"compliance_frameworks": [
{
"compliance_framework": "<framework_name>",
"category": "5. Build Pipeline & Artifact Integrity",
"priority": "high"
}
]
}
This creates a custom alert AND automatically maps it to the framework.
Want me to create this custom alert?
| Method | Endpoint | Purpose |
|---|---|---|
POST | /api/sonar/rules | Create custom alert rule |
GET | /api/sonar/rules/{rule_id} | Read alert rule |
PUT | /api/sonar/rules/{rule_id} | Update alert rule |
DELETE | /api/sonar/rules/{rule_id} | Delete alert rule |
GET | /api/alerts/catalog/category | List available alert categories |
Key fields:
name — Alert titledetails — Description (note: API uses details, not description)category — From /api/alerts/catalog/category (e.g., "Best practices", "Network misconfigurations")orca_score — Severity score (float, e.g., 6.0)rule_json — Discovery query in Orca sonar DSL (object_set with models, keys, operators)compliance_frameworks[] — Auto-map to framework sections:
compliance_framework — Framework name (must match exactly)category — Section name within the frameworkpriority — "high" / "medium" / "low"The response returns a rule_id which can then be added to the custom framework via PUT /api/compliance/frameworks/{id}.
This example was tested live and created as framework ID 3104 with a 28% initial score.
Input: "create a custom compliance framework for supply chain security"
Source frameworks queried:
cis_docker_v.1.3.1 — Container/Docker controlscis_eks_1.5.0 — Kubernetes/EKS controlsstig_k8s — Kubernetes STIG controlsaws_cis_6.0.0 — AWS infrastructure controlsaws_foundational_security_best_practices — AWS security baselinesResult: 39 controls across 6 sections:
| Section | Controls | Source |
|---|---|---|
| 1. Container Image & Registry Security | 6 | CIS Docker, EKS, K8s STIG |
| 2. Container Runtime Protection | 8 | CIS Docker, EKS |
| 3. Kubernetes Admission & Policy Controls | 8 | K8s STIG, EKS |
| 4. Secrets & Credential Management | 7 | EKS, AWS Foundational, AWS CIS |
| 5. Build Pipeline & Artifact Integrity | 4 | AWS Foundational, EKS, AWS CIS |
| 6. Audit Logging & Monitoring | 6 | CIS Docker, K8s STIG, EKS |
Coverage gaps identified (candidates for custom discovery alerts):
=====================================================================
CUSTOM FRAMEWORK BUILDER
=====================================================================
FRAMEWORK: <framework_name>
DESCRIPTION: <1-2 sentence description>
SOURCE: <theme | framework_name | alert list>
---------------------------------------------------------------------
FRAMEWORK STRUCTURE
---------------------------------------------------------------------
Section Controls Priority Breakdown
-----------------------------------------------------------------
<section 1> <N> <H> high, <M> med
<section 2> <N> <H> high, <M> med
...
-----------------------------------------------------------------
TOTAL <N> <H> high, <M> med
SOURCES: <framework_1> (<N> rules), <framework_2> (<N> rules), ...
COVERAGE GAPS (no existing rule — can create custom alerts):
- <gap 1 description>
- <gap 2 description>
=====================================================================
Ready to create? (yes / modify / add section / remove)
Drill down: all controls | <section name> | coverage gaps
=====================================================================
=====================================================================
CUSTOM FRAMEWORK CREATED
=====================================================================
FRAMEWORK <framework_name>
ID <framework_id>
CONTROLS <N> total across <M> sections
INITIAL SCORE <X>%
CLOUD <vendors>
NEXT STEPS:
- View in Orca Console: Compliance -> <framework_name>
- Run /orca-compliance-gap <framework_name> for gap analysis
- Create custom alerts for coverage gaps (see below)
COVERAGE GAPS — fill with custom alerts:
[1] <gap description>
Want me to create a custom discovery alert for this? (yes/no)
[2] <gap description>
...
=====================================================================
No controls found matching "<theme>" in any enabled framework.
Try:
- /orca-custom-framework with specific alert IDs
- /orca-custom-framework from:<existing_framework>
- Provide more specific terms
Framework "<name>" already exists (ID: <id>, Score: <X>%).
Options:
1. Choose a different name
2. Update existing: PUT /api/compliance/frameworks/<id>
3. View it: /orca-compliance-gap <name>
| Tool | Purpose | Parameters |
|---|---|---|
discovery_search | Find alerts matching a theme | search_phrase, limit (1-10) |
get_enabled_compliance_frameworks | List all frameworks | optional filters |
get_compliance_framework_control_tests | Get controls from a framework | framework_id, optional filters |
get_alert | Get alert details | alert_id (e.g., "orca-1234") |
| Method | Endpoint | Purpose |
|---|---|---|
POST | /api/compliance/frameworks | Create custom framework |
PUT | /api/compliance/frameworks/{id} | Update custom framework |
DELETE | /api/compliance/frameworks/{id} | Delete custom framework |
POST | /api/sonar/rules | Create custom discovery alert |
PUT | /api/sonar/rules/{rule_id} | Update custom discovery alert |
Framework creation and custom alert creation both use the Orca REST API via
curl. The auth token is extracted from.mcp.json.
origin_framework_id so users know where each control came from./orca-compliance-gap <framework> for gap analysis and /orca-impact-analysis for fix planning.npx claudepluginhub orcasecurity/orca-skills --plugin orca-skillsAnalyzes compliance gaps across frameworks (PCI DSS, SOC 2, CIS, NIST) — ranks failing controls by impact, identifies quick wins, and generates remediation plans. Use when asked about compliance status or failures.
Guides security professionals in implementing defense-in-depth architectures, achieving compliance (SOC2, ISO27001, GDPR, HIPAA), threat modeling, risk assessment, incident response, and embedding security throughout the SDLC.
Makes cloud accounts compliant with security/industry frameworks via iterative Prowler Cloud setup, reporting, and remediation. Handles provider configuration, framework selection, and step-by-step compliance checking.