feat(fortigate): new FortiGate network-containment integration
FortiOS REST API v2, 11 commands: ban/unban/list banned IPs (quarantine), firewall address object create/delete/list, address-group update/list, firewall policy and service listing. Bearer-token auth, multi-VDOM, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,137 @@
|
||||
id: fortigate
|
||||
name: FortiGate
|
||||
version: 1.0.0
|
||||
description: "Fortinet FortiGate (FortiOS REST API v2) — network containment: ban/unban IP addresses (quarantine), manage firewall address objects and address groups, and read firewall policies and services. API-token authentication; stdlib-only, no extra Python dependencies. Supports multi-VDOM."
|
||||
changelog: "1.0.0 — Initial release: ban/unban/list banned IPs, address object create/delete/list, address-group update/list, firewall policy and service listing."
|
||||
category: network
|
||||
|
||||
# Per-instance configuration. The API token is sent as 'Authorization: Bearer <token>'.
|
||||
# vdom is an optional default applied to every request (overridable per command).
|
||||
config_schema:
|
||||
properties:
|
||||
server:
|
||||
type: string
|
||||
description: "FortiGate URL (e.g. https://192.168.0.1)"
|
||||
api_key:
|
||||
type: string
|
||||
description: "FortiOS REST API token"
|
||||
x-soar-sensitive: true
|
||||
vdom:
|
||||
type: string
|
||||
description: "Default VDOM (leave empty for the management VDOM)"
|
||||
insecure:
|
||||
type: boolean
|
||||
description: "Trust any TLS certificate (not secure)"
|
||||
default: false
|
||||
required:
|
||||
- server
|
||||
- api_key
|
||||
|
||||
commands:
|
||||
- id: ban_ip
|
||||
name: fortigate-ban-ip
|
||||
description: "Quarantine one or more source IP addresses (adds them to the FortiGate banned-IP list)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
ip_addresses: { type: string, description: "Comma-separated IPv4/IPv6 addresses to ban" }
|
||||
expiry_seconds: { type: number, description: "Ban duration in seconds (0 or empty = indefinite)" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: [ip_addresses]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: unban_ip
|
||||
name: fortigate-unban-ip
|
||||
description: "Remove one or more IP addresses from the FortiGate banned-IP list."
|
||||
inputs_schema:
|
||||
properties:
|
||||
ip_addresses: { type: string, description: "Comma-separated addresses to unban (empty = clear all)" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_banned_ips
|
||||
name: fortigate-list-banned-ips
|
||||
description: "List the currently banned (quarantined) IP addresses."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_address
|
||||
name: fortigate-create-firewall-address
|
||||
description: "Create a firewall address object (subnet type)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Address object name" }
|
||||
subnet: { type: string, description: "Subnet as 'IP netmask' or CIDR (e.g. '10.0.0.5 255.255.255.255' or '10.0.0.5/32')" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: [name, subnet]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_address
|
||||
name: fortigate-delete-firewall-address
|
||||
description: "Delete a firewall address object by name."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Address object name" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: [name]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_addresses
|
||||
name: fortigate-list-firewall-addresses
|
||||
description: "List firewall address objects (optionally a single one by name)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Optional address object name to fetch a single entry" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_address_group
|
||||
name: fortigate-update-firewall-address-group
|
||||
description: "Replace the members of a firewall address group (e.g. a blocked-hosts group referenced by a deny policy)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Address group name" }
|
||||
members: { type: string, description: "Comma-separated address object names that become the group's members" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: [name, members]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_address_groups
|
||||
name: fortigate-list-firewall-address-groups
|
||||
description: "List firewall address groups (optionally a single one by name)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Optional address group name to fetch a single entry" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_policies
|
||||
name: fortigate-list-firewall-policies
|
||||
description: "List IPv4 firewall policies (optionally a single one by policy id)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
policy_id: { type: string, description: "Optional policy id to fetch a single entry" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_services
|
||||
name: fortigate-list-firewall-services
|
||||
description: "List custom firewall services (optionally a single one by name)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Optional service name to fetch a single entry" }
|
||||
vdom: { type: string, description: "VDOM override" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: fortigate-test-connection
|
||||
description: "Verify connectivity and the API token (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user