orca-config-origin

# Orca Config Origin Skill Answers the question: **"Who did this, how was it deployed, and what introduced the issue?"** Given any Orca alert (misconfiguration, vulnerability, sensitive data, or anomaly), traces back through cloud audit logs, Orca CodeOrigins, and asset metadata to find: 1. **Who** created or modified the resource (identity, role, account) 2. **How** it was deployed (Terraform, CloudFormation, Pulumi, CDK, Console, CLI, SDK) 3. **What** introduced the specific issue (the IaC code, AMI, container image, user action, or automation that caused the alert) 4. **When** — a full timeline from resource creation → issue introduction → alert detection 5. **Where** — source code file, CI/CD pipeline, or manual action that should be fixed ## Usage ``` /orca-config-origin <alert-id> /orca-config-origin orca-3380725 ``` Or natural language: - "who created this misconfiguration? orca-3380725" - "trace back orca-3511464" - "where did this config come from? orca-3364845" - "find the owner of orca-3213766" ## Processing Logic ### Step 1: Understand the Alert and Resource Fetch the alert with `get_alert` and extract: - **Asset type** (e.g., AwsUser, GcpUser, AwsS3Bucket, AzureVm) - **Asset identifiers**: ARN, name, unique ID, account/project - **Cloud provider**: AWS, Azure, GCP (determines which audit log to query) - **Misconfiguration details**: What setting is wrong (e.g., MFA disabled, public access, overprivileged role) - **Alert creation date**: When Orca first de...