Notifications and alerting

ORCA

Your own push service.Inside your own perimeter.

ORCA delivers notifications to your apps and devices over a connection it maintains itself, parses your logs and turns alert storms into single incidents. In-app push never passes through a Google or Apple service.

Self-hosted on servers you run. In-app delivery needs no third-party service, and ORCA has been tested with no route to the internet.

Dashboard

Total events

1,284,906

Critical / high

312

Open incidents

7

Delivered

9,418

Severity over time

InfoWarningCritical / high

Recent critical / high events

The five most recent critical or high severity events, with the time, source and a one-line summary of each.
TimeSourceSummary
09:41fw-edge-02fw-edge-02Deny burst from 10.4.2.17 to 3 hosts
09:38auth-01auth-0114 failed sudo attempts for svc-backup
09:30db-cluster-2db-cluster-2Replication lag over threshold
09:22vpn-gwvpn-gwTunnel to site-north dropped
09:05web-03web-035xx rate above 4% on /api/orders

Deliveries

  • In-app push6,102
  • Web push1,877
  • Email1,204
  • Webhook235

Clients online

214

Every number above is invented. The layout is modelled on ORCA’s own dashboard.

Your own push service.

In-app push never passes through Google or Apple. The connection, the identity and the record all live on servers you run.

Every app holds its own line.

Phones, browsers and servers keep a live connection to ORCA itself. A notification travels down that line — not through a relay someone else runs.

Three live lines run from ORCA to a field tablet, an operations console and an orders service, each carrying a pulse toward its endpoint.

A device is woken when you need it.

Each device is given its own identity when it is provisioned. Your backend sends it a wake signal through ORCA, and the device checks in.

A single pulse travels from your backend through ORCA to Field tablet 07, which is tagged wake.

Back online, caught up.

A device that was out of reach asks for what it missed when it comes back, and ORCA hands over the messages it kept.

The tablet's line goes dashed while ORCA holds three messages marked kept; when the line returns the messages move to the tablet, fetched on reconnect.

And every delivery is on the record.

Each dispatch is logged with its channel and outcome, and visible in the console — so "did it go out?" has an answer.

A dispatch log lists four deliveries — in-app push, web push, email and webhook — each marked sent, the webhook after one retry.

An alert storm becomes one incident.

Repeats of the same alert fold into a single incident, so the on-call phone rings once. If it gets worse, it rings again. Acknowledge, resolve or silence it from the console.

Incidents

Deny burst · fw-edge-02

148 events folded

CriticalAcknowledged
  1. 09:12First seen — High
  2. 09:12–09:40147 repeats folded, no new notifications
  3. 09:41Escalated to Critical — on-call re-notified
  4. 09:44Acknowledged by a.verma

Maintenance · db-cluster-2

Silenced until 02:00

Silenced

23 events recorded, none dispatched

From a raw line to a structured event.

Point a firewall, a server or a cloud account at ORCA and pick from 47 built-in parsers — or paste a sample line and let the advisor choose. Lines nothing matches wait in a dead-letter queue until you replay them.

Parsers

Raw line

<134>Jun 04 09:41:02 fw-edge-02 date=2026-06-04 time=09:41:02 devname="fw-edge-02" type="traffic" action="deny" srcip=10.4.2.17 dstip=10.4.9.30 dstport=445 proto=6 policyid=12

Advisor

Best matches: kv, syslog:rfc3164, fortinet:fortigate

Chosen for this source: fortinet:fortigate

Extracted fields

devnamefw-edge-02
actiondeny
srcip10.4.2.17
dstip10.4.9.30
dstport445
proto6
policyid12

Parser families — 47 built in

  • Firewalls5
    Fortinet, Check Point, Cisco ASA, pfSense
  • Network, DNS and VPN6
    Juniper, Arista, MikroTik
  • Operating systems6
    Windows Event Log, Sysmon, Linux auditd, PAM, sudo, SSH
  • Databases3
    MySQL, PostgreSQL
  • Web, proxy and mail servers6
    Nginx, Apache, IIS
  • IDS and EDR6
    Suricata, Snort, Zeek, OSSEC
  • Cloud and Kubernetes7
    AWS CloudTrail, Azure, GCP
  • Generic formats8
    JSON, CEF, LEEF, key=value, regex, syslog RFC 5424/3164

Dead letters

1 line held — no parser matched

Replay held lines singly or in bulk through the API.

Four ways to reach the right person.

In-app push
Over the connection your app holds to ORCA.
Browser push
Standards-based web push to subscribed browsers, delivered through each browser’s own push service.
Email
Over TLS, with a templated subject and body.
Webhooks
Signed with HMAC-SHA256 and retried with backoff.

Client SDKs for both ends of the line.

The Android and iOS libraries hold the connection, reconnect with backoff and catch up on missed messages, so your app only handles the message. The Python library is the other end: it provisions devices and sends their wake signals.

SDKs
val store = EncryptedSharedPreferencesTokenStore.create(context)
store.setToken(clientToken) // from POST /v2/provision/device

OrcaClient.start(
    context,
    OrcaConfig(
        serverUrl = "https://orca.example.internal",
        tokenStore = store,
        notification = NotificationConfig(smallIconRes = R.drawable.ic_stat_orca),
    ),
    object : OrcaConnectionListener {
        override fun onMessage(message: OrcaMessage) {
            if (message.isSyncWake()) triggerCheckIn()
        }
        override fun onConnected() {}
        override fun onDisconnected() {}
        override fun onError(error: Throwable) {}
    },
)

Built as the backbone of the platform.

ORCA is the messaging layer the Appdirs platform is built around. Device management wakes its devices through it, AuthX authenticates the services that send, and Kestryn and Prospica send their audit and server logs to it.

See the platform
MDMwakes managed devices through ORCAAuthXauthenticates the services that sendProspicasends its audit and server logsKestrynsends its audit and server logsORCA
MDM
wakes managed devices through ORCA
AuthX
authenticates the services that send
Prospica
sends its audit and server logs
Kestryn
sends its audit and server logs

Built to run where you run it.

Organisations
Applications, policies and incidents are isolated per organisation — multi-tenant, managed from the console or the API.
Roles and audit
Custom roles with fine-grained permissions, scoped per application, and an audit log of every permission-gated change.
Outbound, guarded
Every outbound destination passes an SSRF guard, and webhooks are signed so the receiver can verify them.
Observable
Prometheus metrics, with separate liveness and readiness probes.
Self-hosted
Ships with a hardened systemd unit and a Dockerfile. Optional integrations — single sign-on, an external event store, certificate issuance — connect out only when you turn them on.

See it delivered.

We will run ORCA against your own devices and logs.