Just built a CLI tool to export findings to CSV.

Hey everyone, been diving deep into Orca Security for the past few months for our containerized workloads on AWS. Really liking the posture management and the way it normalizes findings across accounts.

But I kept hitting a wall when I needed to share filtered findings with our finance team for their cloud cost/risk analysis, or even just to do some bulk manipulation outside the UI. The API is powerful, but I needed a quicker way to get a snapshot of, say, all high-severity issues in a specific AWS region into a spreadsheet.

So I spent a weekend and built a simple CLI tool in Python. It uses the Orca API to fetch findings based on a few filters you can set (like severity, asset type, cloud account) and exports them directly to a CSV. It's been a game-changer for our weekly FinOps sync-ups.

Here's the basic usage. You'll need an API key from Orca set as an environment variable (`ORCA_API_KEY`).

```python
# orca_export.py - simplified version
import requests
import csv
import os
import sys

BASE_URL = "https://api.orcasecurity.io/api"
HEADERS = {"Authorization": f"Bearer {os.environ.get('ORCA_API_KEY')}"}

def fetch_findings(severity="high", asset_type="aws_ec2"):
params = {"severity": severity, "asset_type": asset_type}
response = requests.get(f"{BASE_URL}/findings", headers=HEADERS, params=params)
return response.json().get('data', [])

def write_to_csv(findings, filename="orca_findings.csv"):
if not findings:
print("No findings to export.")
return
fieldnames = findings[0].keys()
with open(filename, 'w', newline='') as csvfile:
writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
writer.writeheader()
writer.writerows(findings)

if __name__ == "__main__":
findings_data = fetch_findings(severity=sys.argv[1] if len(sys.argv) > 1 else "high")
write_to_csv(findings_data)
print(f"Exported {len(findings_data)} findings.")
```

Run it with `python orca_export.py medium` to get all medium findings, for example. The full version I'm using has more filters for cloud account IDs and date ranges.

Has anyone else built similar tooling around Orca's data? I'm thinking of adding a feature to map findings to estimated cost implications (like unattached EBS volumes or over-provisioned RDS instances). Would love to compare notes or hear about other workflows people have set up.