policy 0 is deny

src/fgai/recommendations.py

@@ -25,6 +25,10 @@ def _top_values(events: list[LogEvent], field: str, limit: int = 5) -> list[str]
     return [value for value, _ in counter.most_common(limit)]
 
 
+def _top_policy_values(events: list[LogEvent], limit: int = 5) -> list[str]:
+    return [value for value in _top_values(events, "policyid", limit=limit + 1) if value != "0"][:limit]
+
+
 def _events_by_src(events: list[LogEvent]) -> dict[str, list[LogEvent]]:
     grouped: dict[str, list[LogEvent]] = defaultdict(list)
     for event in events:
@@ -47,7 +51,7 @@ def build_recommendations(
         if not src_events:
             continue
 
-        policy_ids = _top_values(src_events, "policyid")
+        policy_ids = _top_policy_values(src_events)
         services = _top_values(src_events, "service")
         dst_ips = [event.dst_ip for event in src_events if event.dst_ip]
         public_dst = [ip for ip in _top_values(src_events, "dstip", limit=10) if is_public_ip(ip)]
@@ -63,7 +67,14 @@ def build_recommendations(
             score = min(100, score + 20)
             reasons.append(f"threat intelligence hit ({'; '.join(bad_reputation[:3])})")
 
-        if is_public_ip(anomaly.subject) and anomaly.score >= 60:
+        if anomaly.evidence.get("implicit_deny_events", 0) and not policy_ids:
+            title = "Implicit deny/drop traffic observed"
+            action = (
+                "FortiGate policyid=0 is the implicit deny/drop path, not an editable firewall policy. "
+                "If this traffic is expected, create a narrow explicit allow policy above the deny using the observed "
+                "source, destination, and service. If it is not expected, keep the deny and investigate or reduce noisy logging."
+            )
+        elif is_public_ip(anomaly.subject) and anomaly.score >= 60:
             title = "Quarantine or block suspicious public source"
             action = (
                 "Inspect the matching FortiGate logs and policy IDs, then quarantine the source IP "