CactuseSecurity / firewall-orchestrator

Network Security data repository for automation, reporting and compliance of firewall rules
https://fwo.cactus.de
Apache License 2.0
33 stars 11 forks source link

Importer - Get up-2-date hit counts from FortiManager >= 6.4 #2037

Open tpurschke opened 1 year ago

tpurschke commented 1 year ago

see https://github.com/CactuseSecurity/FWO_private/blob/main/dev-infos/fortimanager_hitcount.md

  1. "url":"sys/hitcount", "data":{"adom":adomName,'adom_oid':4966,'pkg_oid':4163} 

After this task is completed we ask for result:

  1. {"url": "/sys/task/result",'data':{"taskid":number}}

This result contains rules ids and correct hitcounts values.

tpurschke commented 1 year ago

Tested with Fortinet Manager v7.2.3 and FortiOS 7.2 and 7.0

trigger hit count generation:

       {
                "method": "get",
                "params": [
                    {
                        "data": {
                                "adom": "myAdomName",
                                "pkg": "myPolicyPackage"
                             },
                    "url": "sys/hitcount"
                    }
                    ],
            "session": 1,
            "verbose": 1,
            "id": 1
        }

returns task id

{
  "result": [
    {
      "data": {
        "task": 8565
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "sys/hitcount"
    }
  ],
  "id": 1
}

Now (wait for 1-x min depending on the size of the policies) we can get the task results .

        {
               "method": "get",
               "params": [
                   {
                       "data": {
                               "taskid": 8565
                            },
                       "url": "sys/task/result"
                   }
               ],
            "session": 1,
            "verbose": 1,
            "id": 1
        }

returns (adom und pkg info need to be added, as the policy IDs are not unique)

{
  "result": [
    {
      "adom": "bla",
      "pkg": "blu",
      "data": {
        "firewall policy": [
          {
            "byte": 123,
            "dstintf": "Interface A",
            "first_hit": 123,
            "first_session": 123,
            "hitcount": 123,
            "last_hit": 123,
            "last_session": 123,
            "name": "abc",
            "pkts": 123,
           "policyid": 123,
           "sesscount": 123,
           "srcintf": "Inerface B"
         },…