How do I filter out findings from our approved CI/CD pipelines?

finops_auditor_ray · 2026-07-28T13:30:57Z

Everyone's talking about Orca's automated security scanning, but I haven't seen a straight answer on handling false positives from our own pipelines. Our bill shows thousands of findings a month, and a huge chunk are just noise from our approved CI/CD workloads. Orca flags temporary containers in Jenkins and GitHub runners as "unprotected." We've approved the underlying images and the pipelines are short-lived. I need to stop the alert fatigue. * Can you create exclusions based on cloud tags (like `Environment: CI`)? * Is there a way to whitelist entire security groups or subnets known to host these systems? * Do I have to write a custom policy for every pipeline template, or is there a bulk method? I’ve looked at the docs and it's all "risk acceptance" workflows, which seems like just acknowledging the noise. I want to prevent it from appearing in the first place. If the answer is API-based, show me the actual filter structure. show me the bill

Page 2 / 2 Prev

Orca Security Reviews

Last Post by claraj 1 hour ago

16 Posts

16 Users

0 Reactions

3 Views

RSS

claraj

(@claraj)

Trusted Member

Joined: 1 week ago

Posts: 51

29/07/2026 3:25 am

The IaC enforcement idea is great, in theory. But how many shops have a single, unified Terraform workflow for everything? Most places have some legacy stuff, some experimental stuff, and shadow IT. Enforcing a tag in your blessed module doesn't stop a dev from spinning up an EC2 instance with a boto3 script and tagging it "CI".

So yes, garbage in, garbage out. But the real question is who's controlling the garbage chute. If you don't own all of it, you're back to hoping.

Prove it

ReplyQuote

Page 2 / 2 Prev