first add

README.md

@@ -0,0 +1,71 @@
+# fgAI
+
+Local FortiGate log and policy inspection agent. It parses FortiGate syslog/JSONL logs, audits FortiOS policy exports, highlights UTM events, and can quarantine malicious source IPs through the FortiGate API when explicitly enabled.
+
+Autoblocking is dry-run by default. The tool will not block RFC1918, loopback, multicast, link-local, reserved, or allowlisted addresses unless you change the code.
+
+## Quick Start
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e .
+```
+
+Analyze local logs:
+
+```bash
+fgai analyze-logs --logs logs/fg_syslog.jsonl
+```
+
+Audit a FortiGate policy export:
+
+```bash
+fgai audit-policies --config exports/fortigate.conf
+```
+
+Find block candidates without changing the firewall:
+
+```bash
+fgai suggest-blocks --logs logs/fg_syslog.jsonl
+```
+
+Execute guarded quarantine actions:
+
+```bash
+export FORTIGATE_HOST=192.0.2.10
+export FORTIGATE_API_TOKEN='...'
+fgai suggest-blocks --logs logs/fg_syslog.jsonl --execute --expiry-minutes 60
+```
+
+Optional local LLM summary through Ollama:
+
+```bash
+ollama pull llama3.3
+fgai analyze-logs --logs logs/fg_syslog.jsonl --llm
+```
+
+## FortiGate Inputs
+
+For logs, configure FortiGate syslog to write into a local file such as `logs/fg_syslog.jsonl`. The parser supports common key/value syslog lines and JSONL.
+
+For policies, export a FortiOS config backup and pass it to `audit-policies`.
+
+## Environment
+
+- `FORTIGATE_HOST`: firewall hostname or IP.
+- `FORTIGATE_API_TOKEN`: REST API token.
+- `FORTIGATE_VERIFY_TLS`: `true` or `false`, defaults to `true`.
+- `FGAI_ALLOWLIST`: comma-separated IPs/CIDRs never to block.
+- `OLLAMA_HOST`: defaults to `http://127.0.0.1:11434`.
+- `OLLAMA_MODEL`: defaults to `llama3.3`.
+
+## Safety Model
+
+The agent separates detection from enforcement:
+
+- UTM events are scored from FortiGate logs (`ips`, `virus`, `anomaly`, `ddos`, `webfilter`, `app-ctrl`, `waf`, `dns`).
+- Source IPs must be globally routable and outside the allowlist.
+- Blocking requires `--execute`.
+- The FortiGate API call is limited to the quarantine/banned user monitor endpoint.
+