update

README.md

@@ -18,6 +18,16 @@ Analyze local logs:
 fgai analyze-logs --logs logs/fg_syslog.jsonl
 ```
 
+Test FortiGate API access:
+
+```bash
+export FORTIGATE_HOST=192.0.2.10
+export FORTIGATE_API_TOKEN='...'
+export FORTIGATE_VERIFY_TLS=false
+fgai test-connection
+fgai fetch-policies --output exports/policies.json
+```
+
 Audit a FortiGate policy export:
 
 ```bash
@@ -51,6 +61,18 @@ For logs, configure FortiGate syslog to write into a local file such as `logs/fg
 
 For policies, export a FortiOS config backup and pass it to `audit-policies`.
 
+Example FortiGate syslog target, run on the FortiGate CLI and replace the server IP with this machine:
+
+```text
+config log syslogd setting
+    set status enable
+    set server "192.0.2.50"
+    set port 514
+    set mode udp
+    set format default
+end
+```
+
 ## Environment
 
 - `FORTIGATE_HOST`: firewall hostname or IP.
@@ -68,4 +90,3 @@ The agent separates detection from enforcement:
 - Source IPs must be globally routable and outside the allowlist.
 - Blocking requires `--execute`.
 - The FortiGate API call is limited to the quarantine/banned user monitor endpoint.
-