I do not know ORCA, but it looks like it is a Vulnerability scanner, which can be really helpful in the security space, but I would think that of ITSM it is not a sufficient data source, you will need something that also discovers OS CI's, Cloud CI's, Applications CIs and most importantly how these things relate to each other.. For this I would recommend ITOM Visibility, but other tools that discovers the relationship, and that has a good Integration to the ServiceNow Platform could also do the job.
I do see that there is a ORCA connector on the ServiceNow store, so that is a good start if you like to enrich the CMDB with Vulnerability data.
