riposte-marketplace/integrations/fortigate/manifest.yaml

id: fortigate
name: FortiGate
version: 1.1.0
description: "Fortinet FortiGate (FortiOS REST API v2) — network containment: ban/unban IP addresses (quarantine), manage firewall address objects and address groups, and read firewall policies and services. API-token authentication; stdlib-only, no extra Python dependencies. Supports multi-VDOM."
changelog: "1.1.0 — Declare the risk tier on the 5 commands that carried none: 1 safe_write, 4 destructive. An unset risk is read as destructive by the agent approval gate, so the 1 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: ban/unban/list banned IPs, address object create/delete/list, address-group update/list, firewall policy and service listing."
category: network

# Per-instance configuration. The API token is sent as 'Authorization: Bearer <token>'.
# vdom is an optional default applied to every request (overridable per command).
config_schema:
  properties:
    server:
      type: string
      description: "FortiGate URL (e.g. https://192.168.0.1)"
    api_key:
      type: string
      description: "FortiOS REST API token"
      x-soar-sensitive: true
    vdom:
      type: string
      description: "Default VDOM (leave empty for the management VDOM)"
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - server
    - api_key

commands:
  - id: ban_ip
    name: fortigate-ban-ip
    description: "Quarantine one or more source IP addresses (adds them to the FortiGate banned-IP list)."
    risk: destructive
    inputs_schema:
      properties:
        ip_addresses: { type: string, description: "Comma-separated IPv4/IPv6 addresses to ban" }
        expiry_seconds: { type: number, description: "Ban duration in seconds (0 or empty = indefinite)" }
        vdom: { type: string, description: "VDOM override" }
      required: [ip_addresses]
    outputs_schema: { properties: {} }
  - id: unban_ip
    name: fortigate-unban-ip
    description: "Remove one or more IP addresses from the FortiGate banned-IP list."
    risk: destructive
    inputs_schema:
      properties:
        ip_addresses: { type: string, description: "Comma-separated addresses to unban (empty = clear all)" }
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_banned_ips
    name: fortigate-list-banned-ips
    description: "List the currently banned (quarantined) IP addresses."
    risk: read
    inputs_schema:
      properties:
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }
  - id: create_address
    name: fortigate-create-firewall-address
    description: "Create a firewall address object (subnet type)."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Address object name" }
        subnet: { type: string, description: "Subnet as 'IP netmask' or CIDR (e.g. '10.0.0.5 255.255.255.255' or '10.0.0.5/32')" }
        comment: { type: string, description: "Optional comment" }
        vdom: { type: string, description: "VDOM override" }
      required: [name, subnet]
    outputs_schema: { properties: {} }
  - id: delete_address
    name: fortigate-delete-firewall-address
    description: "Delete a firewall address object by name."
    risk: destructive
    inputs_schema:
      properties:
        name: { type: string, description: "Address object name" }
        vdom: { type: string, description: "VDOM override" }
      required: [name]
    outputs_schema: { properties: {} }
  - id: list_addresses
    name: fortigate-list-firewall-addresses
    description: "List firewall address objects (optionally a single one by name)."
    risk: read
    inputs_schema:
      properties:
        name: { type: string, description: "Optional address object name to fetch a single entry" }
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }
  - id: update_address_group
    name: fortigate-update-firewall-address-group
    description: "Replace the members of a firewall address group (e.g. a blocked-hosts group referenced by a deny policy)."
    risk: destructive
    inputs_schema:
      properties:
        name: { type: string, description: "Address group name" }
        members: { type: string, description: "Comma-separated address object names that become the group's members" }
        vdom: { type: string, description: "VDOM override" }
      required: [name, members]
    outputs_schema: { properties: {} }
  - id: list_address_groups
    name: fortigate-list-firewall-address-groups
    description: "List firewall address groups (optionally a single one by name)."
    risk: read
    inputs_schema:
      properties:
        name: { type: string, description: "Optional address group name to fetch a single entry" }
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_policies
    name: fortigate-list-firewall-policies
    description: "List IPv4 firewall policies (optionally a single one by policy id)."
    risk: read
    inputs_schema:
      properties:
        policy_id: { type: string, description: "Optional policy id to fetch a single entry" }
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_services
    name: fortigate-list-firewall-services
    description: "List custom firewall services (optionally a single one by name)."
    risk: read
    inputs_schema:
      properties:
        name: { type: string, description: "Optional service name to fetch a single entry" }
        vdom: { type: string, description: "VDOM override" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: fortigate-test-connection
    description: "Verify connectivity and the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }