orca-asset-profile

# Orca Asset Profile Skill Answers the question: **"Tell me everything about this asset in one place."** Given an asset name, ID, or ARN, provides a complete 360° security profile: all open alerts (grouped by category), attack paths, compliance violations, permissions, network exposure, sensitive data, CDR activity summary, crown jewel status, and linked entities. ## Usage ``` /orca-asset-profile web-bastion-host /orca-asset-profile i-1234567890abcdef0 /orca-asset-profile arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 ``` Or natural language: - "tell me about web-bastion-host" - "profile CI-SERVER-01-PRD" - "asset risk for vm-chain3-1" - "what do we know about this instance?" ## Processing Logic ### Step 1: Find the Asset Determine the input type and use the appropriate tool: | Input Pattern | Tool | Parameter | |--------------|------|-----------| | `orca-XXXX` (alert ID) | `get_asset_by_alert_id` | `alert_id` | | UUID format | `get_asset_by_id` | `asset_id` | | `vm_XXXX`, `AwsXXX_XXXX` (asset_unique_id) | `get_asset_by_id` | `asset_id` + `model_type` | | ARN format `arn:aws:...` | `get_asset_by_id` or `discovery_search` | varies | | Name (anything else) | `get_asset_by_name` | `asset_name` | If `get_asset_by_name` returns multiple results, show the list and ask the user to pick. ### Step 2: Gather All Data (run ALL in parallel) Once the asset is identified, extract its UUID (`Inventory.id` or `id`), `asset_unique_id`, `group_unique_id`, and ARN, ...