Local FortiGate log and policy inspection agent. It parses FortiGate syslog/JSONL logs, audits FortiOS policy exports, highlights UTM events, and can quarantine malicious source IPs through the FortiGate API when explicitly enabled.

Autoblocking is dry-run by default. The tool will not block RFC1918, loopback, multicast, link-local, reserved, or allowlisted addresses unless you change the code.

Quick Start

python -m venv .venv
source .venv/bin/activate
pip install -e .

Analyze local logs:

fgai analyze-logs --logs logs/fg_syslog.jsonl

Audit a FortiGate policy export:

fgai audit-policies --config exports/fortigate.conf

Find block candidates without changing the firewall:

fgai suggest-blocks --logs logs/fg_syslog.jsonl

Execute guarded quarantine actions:

export FORTIGATE_HOST=192.0.2.10
export FORTIGATE_API_TOKEN='...'
fgai suggest-blocks --logs logs/fg_syslog.jsonl --execute --expiry-minutes 60

Optional local LLM summary through Ollama:

ollama pull llama3.3
fgai analyze-logs --logs logs/fg_syslog.jsonl --llm

FortiGate Inputs

For logs, configure FortiGate syslog to write into a local file such as logs/fg_syslog.jsonl. The parser supports common key/value syslog lines and JSONL.

For policies, export a FortiOS config backup and pass it to audit-policies.

Environment

FORTIGATE_HOST: firewall hostname or IP.
FORTIGATE_API_TOKEN: REST API token.
FORTIGATE_VERIFY_TLS: true or false, defaults to true.
FGAI_ALLOWLIST: comma-separated IPs/CIDRs never to block.
OLLAMA_HOST: defaults to http://127.0.0.1:11434.
OLLAMA_MODEL: defaults to llama3.3.

Safety Model

The agent separates detection from enforcement:

UTM events are scored from FortiGate logs (ips, virus, anomaly, ddos, webfilter, app-ctrl, waf, dns).
Source IPs must be globally routable and outside the allowlist.
Blocking requires --execute.
The FortiGate API call is limited to the quarantine/banned user monitor endpoint.