From f0bbc7e56c4e6184c83a78242b56662be3ecc6e1 Mon Sep 17 00:00:00 2001
From: Gustavo Lichti <gustavo.lichti@gmail.com>
Date: Mon, 27 Jan 2025 19:11:43 -0300
Subject: [PATCH 1/2] api_start_date - New Parameter

---
 .../Orca Security/Orca-Security-Workflow-Parameter-Values.xml    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Community Developed/Orca Security/Orca-Security-Workflow-Parameter-Values.xml b/Community Developed/Orca Security/Orca-Security-Workflow-Parameter-Values.xml
index 8db1bf73..55762193 100644
--- a/Community Developed/Orca Security/Orca-Security-Workflow-Parameter-Values.xml	
+++ b/Community Developed/Orca Security/Orca-Security-Workflow-Parameter-Values.xml	
@@ -2,4 +2,5 @@
 <WorkflowParameterValues xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/WorkflowParameterValues/V1">
 	<Value name="api_host" value="api.orcasecurity.io" />
 	<Value name="api_token" value="" />
+	<Value name="api_start_date" value="" />
 </WorkflowParameterValues>

From 1588c4b012aaa38fcd150db45bf506128720cbf7 Mon Sep 17 00:00:00 2001
From: Gustavo Lichti <gustavo.lichti@gmail.com>
Date: Mon, 27 Jan 2025 19:14:59 -0300
Subject: [PATCH 2/2] Add api_start_date parameter

---
 Community Developed/Orca Security/Orca-Security-Workflow.xml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Community Developed/Orca Security/Orca-Security-Workflow.xml b/Community Developed/Orca Security/Orca-Security-Workflow.xml
index a1248694..833e75dc 100644
--- a/Community Developed/Orca Security/Orca-Security-Workflow.xml	
+++ b/Community Developed/Orca Security/Orca-Security-Workflow.xml	
@@ -16,6 +16,7 @@ Parameters:
     <Parameters>
         <Parameter name="api_host" label="API Host" required="true" default="api.orcasecurity.io" />
         <Parameter name="api_token" label="API Token" required="true" secret="true" />
+        <Parameter name="api_start_date" label="API Start Date" required="true" default="0" />
     </Parameters>
 
     <Actions>
@@ -28,7 +29,7 @@ Parameters:
             <Set path="/last_updated" value="${/successful_event_start_time}" />
         </If>
         <Else>
-            <Set path="/last_updated" value="0" />
+            <Set path="/last_updated" value="${/api_start_date}" />
         </Else>
 
         <CallEndpoint url="https://${/api_host}/api/rules/query/alerts" method="POST" savePath="/get_alerts">
@@ -114,4 +115,4 @@ Parameters:
         <HTTPConnectionThroughProxyTest url="https://${/api_host}" />
     </Tests>
 
-</Workflow>
\ No newline at end of file
+</Workflow>