{"resources":{"asset":{"id":"asset","name":"asset","fields":{"purl":{"name":"purl","type":"\u0007","title":"Platform identifier in package URL (purl) format","desc":"Package URL that encodes the connected FortiOS device's platform name and firmware version, for example `pkg:platform/FortiOS@v7.6.4?runtime=...`. Built from the asset's detected platform name and version, with the platform runtime carried as a `runtime` qualifier when present. Used to key the asset against vulnerability and inventory data. Empty when no FortiOS connection or platform metadata is available.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"is_extension":true,"provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios":{"id":"fortios","fields":{"firewall":{"name":"firewall","type":"\u001bfortios.firewall","title":"FortiOS firewall configuration","desc":"Root of the device's firewall object model, backed by the FortiOS configuration database (CMDB). Address objects and groups are available through `addresses` and `addressGroups`, user-defined service definitions through `serviceCustoms`, and the ordered rule base through `policies`. Use it to audit the ruleset, for example `fortios.firewall.policies.where(action == \"accept\" \u0026\u0026 nat == \"enable\")` to find every allow rule that also source-NATs.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"log":{"name":"log","type":"\u001bfortios.log","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"network":{"name":"network","type":"\u001bfortios.network","title":"FortiOS network configuration","desc":"Root of the device's interface model, backed by `config system interface` in the FortiOS configuration database. The `interfaces` field enumerates every physical and virtual interface, the starting point for auditing addressing, permitted management access, VDOM membership, and interface roles.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"router":{"name":"router","type":"\u001bfortios.router","title":"Router configuration","desc":"Device routing configuration surfaced from the FortiOS router CMDB. Static routes are available through `staticRoutes`, dynamic routing through `bgp` and `ospf`, and policy-based routing through `policies`. It audits how the device forwards traffic, including default routes, blackhole entries, and the peering topology of dynamic protocols.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"system":{"name":"system","type":"\u001bfortios.system","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true}},"is_extension":true},"fortios.firewall":{"id":"fortios.firewall","name":"fortios.firewall","fields":{"address":{"name":"address","type":"\u001bfortios.firewall.address","title":"FortiOS firewall address object","desc":"A named entry from `config firewall address` that firewall policies reference by name. The `name` field selects the object, for example `fortios.firewall.address(name: \"all\")`. The `type` field determines which value field carries the definition: a subnet, an IP range, an FQDN, or a country code.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"addressGroup":{"name":"addressGroup","type":"\u001bfortios.firewall.addressGroup","title":"FortiOS firewall address group","desc":"A named group from `config firewall addrgrp` that firewall policies can reference in place of listing individual address objects. The `name` field selects the group, for example `fortios.firewall.addressGroup(name: \"internal-nets\")`, and `members` lists the address objects (or nested groups) it contains.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"addressGroups":{"name":"addressGroups","type":"\u0019\u001bfortios.firewall.addressGroup","title":"Firewall address groups from config firewall addrgrp","provider":"go.mondoo.com/cnquery/providers/fortios"},"addresses":{"name":"addresses","type":"\u0019\u001bfortios.firewall.address","title":"Firewall address objects from config firewall address","provider":"go.mondoo.com/cnquery/providers/fortios"},"policies":{"name":"policies","type":"\u0019\u001bfortios.firewall.policy","title":"Firewall policies (the ordered IPv4 rule base) from config firewall policy","provider":"go.mondoo.com/cnquery/providers/fortios"},"policy":{"name":"policy","type":"\u001bfortios.firewall.policy","title":"FortiOS firewall policy","desc":"A single IPv4 rule from `config firewall policy`, part of the ordered rule base evaluated top to bottom until the first match. The `policyid` field is the unique numeric ID that selects the rule, for example `fortios.firewall.policy(policyid: 1)`. Its match criteria (source and destination interfaces, addresses, services, schedule) plus its action, NAT setting, and the attached UTM profiles (`avProfile`, `webfilterProfile`, `ipsSensor`, `applicationList`, `sslSshProfile`) make it the central object for auditing what traffic is permitted and what inspection is applied to it.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"serviceCustom":{"name":"serviceCustom","type":"\u001bfortios.firewall.serviceCustom","title":"FortiOS custom firewall service object","desc":"A user-defined service from `config firewall service custom`, defining a protocol and its port set (or ICMP type/code) that firewall policies reference by name. The `name` field selects the object, for example `fortios.firewall.serviceCustom(name: \"HTTPS\")`. The `protocol` field determines which port-range, type/code, or protocol-number fields are meaningful.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"serviceCustoms":{"name":"serviceCustoms","type":"\u0019\u001bfortios.firewall.serviceCustom","title":"User-defined service objects from config firewall service custom","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS firewall configuration","desc":"Root of the device's firewall object model, backed by the FortiOS configuration database (CMDB). Address objects and groups are available through `addresses` and `addressGroups`, user-defined service definitions through `serviceCustoms`, and the ordered rule base through `policies`. Use it to audit the ruleset, for example `fortios.firewall.policies.where(action == \"accept\" \u0026\u0026 nat == \"enable\")` to find every allow rule that also source-NATs.","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.firewall.address":{"id":"fortios.firewall.address","name":"fortios.firewall.address","fields":{"allowRouting":{"name":"allowRouting","type":"\u0007","is_mandatory":true,"title":"Whether static-route and policy-route destinations may use this object","desc":"One of \"enable\" or \"disable\". When \"enable\" the address can be selected as a routing destination.","provider":"go.mondoo.com/cnquery/providers/fortios"},"associatedInterface":{"name":"associatedInterface","type":"\u0007","is_mandatory":true,"title":"Interface this address object is bound to","desc":"Restricts where the object is valid. Empty (or \"any\") when the object applies to all interfaces.","provider":"go.mondoo.com/cnquery/providers/fortios"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment on the address object","provider":"go.mondoo.com/cnquery/providers/fortios"},"country":{"name":"country","type":"\u0007","is_mandatory":true,"title":"Two-letter ISO 3166 country code, for the \"geography\" type","desc":"For example \"US\" or \"CN\". Empty for other types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"endIp":{"name":"endIp","type":"\u0007","is_mandatory":true,"title":"End IP address, for the \"iprange\" type","desc":"Empty for other types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name, for the \"fqdn\" type","desc":"The FQDN whose resolved addresses the object matches. Empty for other types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Address object name","provider":"go.mondoo.com/cnquery/providers/fortios"},"startIp":{"name":"startIp","type":"\u0007","is_mandatory":true,"title":"Start IP address, for the \"iprange\" type","desc":"Empty for other types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"subnet":{"name":"subnet","type":"\u0007","is_mandatory":true,"title":"Subnet in \"address netmask\" form, for the \"ipmask\" type","desc":"For example \"192.168.1.0 255.255.255.0\". \"0.0.0.0 0.0.0.0\" for the built-in \"all\" object. Empty for non-ipmask types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Address object type","desc":"Selects which value field is meaningful. Common values: \"ipmask\" (subnet, in the subnet field), \"iprange\" (startIp to endIp), \"fqdn\" (domain name, in fqdn), and \"geography\" (country code, in country). FortiOS also supports \"wildcard-fqdn\", \"wildcard\" (IP plus wildcard mask), \"mac\", \"dynamic\" (SDN connector), and \"interface-subnet\"; those definitions are not exposed as separate value fields here.","provider":"go.mondoo.com/cnquery/providers/fortios"},"visibility":{"name":"visibility","type":"\u0007","is_mandatory":true,"title":"Whether the object is shown in the GUI address list","desc":"One of \"enable\" or \"disable\". Cosmetic; does not affect matching.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"FortiOS firewall address object","desc":"A named entry from `config firewall address` that firewall policies reference by name. The `name` field selects the object, for example `fortios.firewall.address(name: \"all\")`. The `type` field determines which value field carries the definition: a subnet, an IP range, an FQDN, or a country code.","private":true,"defaults":"name type","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.firewall.addressGroup":{"id":"fortios.firewall.addressGroup","name":"fortios.firewall.addressGroup","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment on the address group","provider":"go.mondoo.com/cnquery/providers/fortios"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the address objects (or nested address groups) that belong to the group","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Address group name","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"FortiOS firewall address group","desc":"A named group from `config firewall addrgrp` that firewall policies can reference in place of listing individual address objects. The `name` field selects the group, for example `fortios.firewall.addressGroup(name: \"internal-nets\")`, and `members` lists the address objects (or nested groups) it contains.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.firewall.policy":{"id":"fortios.firewall.policy","name":"fortios.firewall.policy","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action taken on matching traffic","desc":"One of \"accept\" (permit), \"deny\" (drop), or \"ipsec\" (route into a policy-based IPsec tunnel). Deny rules typically have no NAT or UTM profiles.","provider":"go.mondoo.com/cnquery/providers/fortios"},"applicationList":{"name":"applicationList","type":"\u0007","is_mandatory":true,"title":"Name of the application control list applied by the policy","desc":"Empty when no application control list is attached.","provider":"go.mondoo.com/cnquery/providers/fortios"},"avProfile":{"name":"avProfile","type":"\u0007","is_mandatory":true,"title":"Name of the antivirus profile applied by the policy","desc":"Empty when no antivirus profile is attached.","provider":"go.mondoo.com/cnquery/providers/fortios"},"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Free-form comments on the policy","provider":"go.mondoo.com/cnquery/providers/fortios"},"dstaddr":{"name":"dstaddr","type":"\u0019\u0007","is_mandatory":true,"title":"Destination address objects matched by the policy","desc":"Names of firewall.address or firewall.addressGroup objects.","provider":"go.mondoo.com/cnquery/providers/fortios"},"dstintf":{"name":"dstintf","type":"\u0019\u0007","is_mandatory":true,"title":"Destination interfaces matched by the policy","desc":"Interface or zone names; \"any\" matches all interfaces.","provider":"go.mondoo.com/cnquery/providers/fortios"},"ipsSensor":{"name":"ipsSensor","type":"\u0007","is_mandatory":true,"title":"Name of the IPS sensor applied by the policy","desc":"Empty when no IPS sensor is attached.","provider":"go.mondoo.com/cnquery/providers/fortios"},"logtraffic":{"name":"logtraffic","type":"\u0007","is_mandatory":true,"title":"Which traffic is logged for this policy","desc":"One of \"all\" (log every session), \"utm\" (log only sessions that trigger a security event), or \"disable\" (no logging).","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","desc":"Empty for older rules created before naming was required.","provider":"go.mondoo.com/cnquery/providers/fortios"},"nat":{"name":"nat","type":"\u0007","is_mandatory":true,"title":"Whether source NAT is applied to matching traffic","desc":"One of \"enable\" or \"disable\". When \"enable\", matching traffic is source-NATed (to the outgoing interface IP unless an IP pool is set).","provider":"go.mondoo.com/cnquery/providers/fortios"},"policyid":{"name":"policyid","type":"\u0005","is_mandatory":true,"title":"Numeric policy ID that uniquely identifies the rule","provider":"go.mondoo.com/cnquery/providers/fortios"},"schedule":{"name":"schedule","type":"\u0007","is_mandatory":true,"title":"Name of the schedule controlling when the policy is active","desc":"A recurring or one-time schedule; \"always\" when the rule is always in effect.","provider":"go.mondoo.com/cnquery/providers/fortios"},"service":{"name":"service","type":"\u0019\u0007","is_mandatory":true,"title":"Service objects matched by the policy","desc":"Names of predefined or firewall.serviceCustom service objects; \"ALL\" matches every protocol and port.","provider":"go.mondoo.com/cnquery/providers/fortios"},"srcaddr":{"name":"srcaddr","type":"\u0019\u0007","is_mandatory":true,"title":"Source address objects matched by the policy","desc":"Names of firewall.address or firewall.addressGroup objects.","provider":"go.mondoo.com/cnquery/providers/fortios"},"srcintf":{"name":"srcintf","type":"\u0019\u0007","is_mandatory":true,"title":"Source interfaces matched by the policy","desc":"Interface or zone names; \"any\" matches all interfaces.","provider":"go.mondoo.com/cnquery/providers/fortios"},"sslSshProfile":{"name":"sslSshProfile","type":"\u0007","is_mandatory":true,"title":"Name of the SSL/SSH inspection profile applied by the policy","desc":"Empty when no inspection profile is attached, meaning encrypted traffic is not decrypted and the other UTM profiles cannot inspect it.","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the policy is enabled","desc":"One of \"enable\" or \"disable\". A disabled rule is skipped during policy evaluation.","provider":"go.mondoo.com/cnquery/providers/fortios"},"utmStatus":{"name":"utmStatus","type":"\u0007","is_mandatory":true,"title":"Whether unified threat management (UTM) inspection is enabled","desc":"One of \"enable\" or \"disable\". When \"disable\", the attached UTM profile fields are ignored even if populated.","provider":"go.mondoo.com/cnquery/providers/fortios"},"webfilterProfile":{"name":"webfilterProfile","type":"\u0007","is_mandatory":true,"title":"Name of the web filter profile applied by the policy","desc":"Empty when no web filter profile is attached.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"policyid","type":"\u0005"}]},"title":"FortiOS firewall policy","desc":"A single IPv4 rule from `config firewall policy`, part of the ordered rule base evaluated top to bottom until the first match. The `policyid` field is the unique numeric ID that selects the rule, for example `fortios.firewall.policy(policyid: 1)`. Its match criteria (source and destination interfaces, addresses, services, schedule) plus its action, NAT setting, and the attached UTM profiles (`avProfile`, `webfilterProfile`, `ipsSensor`, `applicationList`, `sslSshProfile`) make it the central object for auditing what traffic is permitted and what inspection is applied to it.","private":true,"defaults":"policyid name action","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.firewall.serviceCustom":{"id":"fortios.firewall.serviceCustom","name":"fortios.firewall.serviceCustom","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category the service is grouped under in the GUI","desc":"For example \"Web Access\", \"File Access\", \"Email\", \"Network Services\", or \"General\". Empty when uncategorized.","provider":"go.mondoo.com/cnquery/providers/fortios"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment on the service object","provider":"go.mondoo.com/cnquery/providers/fortios"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name the service is scoped to","desc":"Used by explicit-proxy services to restrict the service to a host. Empty when not scoped to an FQDN.","provider":"go.mondoo.com/cnquery/providers/fortios"},"icmpcode":{"name":"icmpcode","type":"\u0007","is_mandatory":true,"title":"ICMP code value, for the \"ICMP\"/\"ICMP6\" protocol types","desc":"Empty when the service applies to all codes for the type.","provider":"go.mondoo.com/cnquery/providers/fortios"},"icmptype":{"name":"icmptype","type":"\u0007","is_mandatory":true,"title":"ICMP type value, for the \"ICMP\"/\"ICMP6\" protocol types","desc":"Empty when the service applies to all ICMP types.","provider":"go.mondoo.com/cnquery/providers/fortios"},"iprange":{"name":"iprange","type":"\u0007","is_mandatory":true,"title":"IP range the service is scoped to","desc":"Used by explicit-proxy services to restrict the service to a destination address range. Empty when not scoped to an IP range.","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service object name","provider":"go.mondoo.com/cnquery/providers/fortios"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol family of the service","desc":"Selects which of the port-range, type/code, or protocolNumber fields apply. Common values: \"TCP/UDP/SCTP\" (uses tcpPortrange / udpPortrange / sctpPortrange), \"ICMP\" and \"ICMP6\" (use icmptype / icmpcode), \"IP\" (uses protocolNumber), and \"ALL\". Explicit-proxy deployments also use \"HTTP\", \"FTP\", \"CONNECT\", \"SOCKS-TCP\", and \"SOCKS-UDP\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"protocolNumber":{"name":"protocolNumber","type":"\u0005","is_mandatory":true,"title":"IP protocol number (0-255), for the \"IP\" protocol type","desc":"Meaningful only when protocol is \"IP\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"sctpPortrange":{"name":"sctpPortrange","type":"\u0007","is_mandatory":true,"title":"SCTP port range(s), for the \"TCP/UDP/SCTP\" protocol type","desc":"Same syntax as tcpPortrange. Empty when the service defines no SCTP ports.","provider":"go.mondoo.com/cnquery/providers/fortios"},"sessionTtl":{"name":"sessionTtl","type":"\u0007","is_mandatory":true,"title":"Per-service session time-to-live override, in seconds","desc":"Range 300-2764800. \"0\" (or empty) means the service uses the global session TTL instead of an override.","provider":"go.mondoo.com/cnquery/providers/fortios"},"tcpPortrange":{"name":"tcpPortrange","type":"\u0007","is_mandatory":true,"title":"TCP port range(s), for the \"TCP/UDP/SCTP\" protocol type","desc":"One or more space-separated ranges, each \"low-high[:src-low-src-high]\" (a single number for one port), for example \"443\" or \"8080-8090\". Empty when the service defines no TCP ports.","provider":"go.mondoo.com/cnquery/providers/fortios"},"udpPortrange":{"name":"udpPortrange","type":"\u0007","is_mandatory":true,"title":"UDP port range(s), for the \"TCP/UDP/SCTP\" protocol type","desc":"Same syntax as tcpPortrange. Empty when the service defines no UDP ports.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"FortiOS custom firewall service object","desc":"A user-defined service from `config firewall service custom`, defining a protocol and its port set (or ICMP type/code) that firewall policies reference by name. The `name` field selects the object, for example `fortios.firewall.serviceCustom(name: \"HTTPS\")`. The `protocol` field determines which port-range, type/code, or protocol-number fields are meaningful.","private":true,"defaults":"name protocol","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.log":{"id":"fortios.log","fields":{"fortianalyzer":{"name":"fortianalyzer","type":"\u001bfortios.log.fortianalyzer","title":"FortiAnalyzer logging settings","desc":"Global configuration for shipping logs to a FortiAnalyzer appliance, read from `config log fortianalyzer setting`: whether it is enabled, the destination server, upload cadence, reliable delivery, and the integrity/encryption algorithms protecting the log channel. Reliable, encrypted FortiAnalyzer logging is a common compliance requirement, and these fields confirm the OFTP channel is authenticated and encrypted rather than sent in the clear. This reflects only the primary FortiAnalyzer target, not the fortianalyzer2/3 targets.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"setting":{"name":"setting","type":"\u001bfortios.log.setting","title":"FortiOS global log settings","desc":"Device-wide logging behavior from `config log setting`: which traffic classes are logged, how log records are formatted, and privacy controls. These settings determine whether implicit-deny hits, local-in traffic (to the device itself), and local-out traffic (originated by the device) are recorded, which is central to auditing log coverage for incident response.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"syslog":{"name":"syslog","type":"\u001bfortios.log.syslog","title":"Remote syslog server logging settings","desc":"Global configuration for forwarding logs to a remote syslog server, read from `config log syslogd setting`: whether forwarding is on, the destination server and port, the transport mode, the syslog facility, the source IP, and the on-wire record format. Auditing these fields confirms logs are shipped off-box for retention and SIEM ingestion, and that a resilient transport is used where required. This reflects only the primary syslog target; FortiOS also supports syslogd2/3/4 targets that are not surfaced here.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true}},"is_extension":true},"fortios.log.fortianalyzer":{"id":"fortios.log.fortianalyzer","name":"fortios.log.fortianalyzer","fields":{"encAlgorithm":{"name":"encAlgorithm","type":"\u0007","is_mandatory":true,"title":"Encryption strength for the FortiAnalyzer log channel","desc":"One of \"high-medium\" (high and medium strength cipher suites), \"high\" (high strength only), \"low\" (includes low strength ciphers), or \"disable\" (no SSL encryption). Only applies when the channel is SSL-protected.","provider":"go.mondoo.com/cnquery/providers/fortios"},"hmacAlgorithm":{"name":"hmacAlgorithm","type":"\u0007","is_mandatory":true,"title":"HMAC algorithm protecting log-record integrity","desc":"One of \"sha256\" or \"sha1\". SHA-256 is preferred; SHA-1 is retained for compatibility with older FortiAnalyzer units.","provider":"go.mondoo.com/cnquery/providers/fortios"},"reliable":{"name":"reliable","type":"\u0007","is_mandatory":true,"title":"Whether reliable (TCP) log delivery is enabled","desc":"One of \"enable\" (reliable OFTP over TCP) or \"disable\" (best-effort UDP). Reliable delivery avoids silent log loss on a congested link.","provider":"go.mondoo.com/cnquery/providers/fortios"},"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"FortiAnalyzer server hostname or IP address","provider":"go.mondoo.com/cnquery/providers/fortios"},"sourceIp":{"name":"sourceIp","type":"\u0007","is_mandatory":true,"title":"Source IP address used for FortiAnalyzer communication","desc":"Pins the source address of the OFTP log channel to a specific interface IP. Empty when the device selects the source by route.","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether FortiAnalyzer logging is enabled","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"uploadOption":{"name":"uploadOption","type":"\u0007","is_mandatory":true,"title":"When logs are uploaded to FortiAnalyzer","desc":"One of \"store-and-upload\" (buffer to local disk, then upload), \"realtime\" (send each record immediately), \"1-minute\" (batch at most once per minute), or \"5-minute\" (batch at most once every five minutes).","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiAnalyzer logging settings","desc":"Global configuration for shipping logs to a FortiAnalyzer appliance, read from `config log fortianalyzer setting`: whether it is enabled, the destination server, upload cadence, reliable delivery, and the integrity/encryption algorithms protecting the log channel. Reliable, encrypted FortiAnalyzer logging is a common compliance requirement, and these fields confirm the OFTP channel is authenticated and encrypted rather than sent in the clear. This reflects only the primary FortiAnalyzer target, not the fortianalyzer2/3 targets.","defaults":"status server","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.log.setting":{"id":"fortios.log.setting","name":"fortios.log.setting","fields":{"briefTrafficFormat":{"name":"briefTrafficFormat","type":"\u0007","is_mandatory":true,"title":"Whether traffic logs use the brief (compact) format","desc":"When \"enable\", traffic log entries are written in a shortened format. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"daemonLog":{"name":"daemonLog","type":"\u0007","is_mandatory":true,"title":"Whether internal daemon activity is logged","desc":"When \"enable\", the FortiGate records its own daemon/service events. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"extendedLog":{"name":"extendedLog","type":"\u0007","is_mandatory":true,"title":"Whether the extended traffic log format is used","desc":"When \"enable\", traffic logs include additional detail fields. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"fwpolicyImplicitLog":{"name":"fwpolicyImplicitLog","type":"\u0007","is_mandatory":true,"title":"Whether the implicit deny firewall policy is logged","desc":"When \"enable\", traffic dropped by the implicit default-deny policy is recorded, giving visibility into blocked flows. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"localInAllow":{"name":"localInAllow","type":"\u0007","is_mandatory":true,"title":"Whether allowed local-in traffic (to the device itself) is logged","desc":"Logs traffic destined to the FortiGate that a local-in policy permits. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"localInDenyBroadcast":{"name":"localInDenyBroadcast","type":"\u0007","is_mandatory":true,"title":"Whether denied broadcast local-in traffic is logged","desc":"Logs broadcast/multicast traffic to the FortiGate that a local-in policy denies. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"localInDenyUnicast":{"name":"localInDenyUnicast","type":"\u0007","is_mandatory":true,"title":"Whether denied unicast local-in traffic is logged","desc":"Logs unicast traffic to the FortiGate that a local-in policy denies. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"localOut":{"name":"localOut","type":"\u0007","is_mandatory":true,"title":"Whether local-out traffic (originated by the device) is logged","desc":"Logs traffic the FortiGate itself originates, such as management and update connections. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"logPolicyComment":{"name":"logPolicyComment","type":"\u0007","is_mandatory":true,"title":"Whether firewall policy comments are included in logs","desc":"When \"enable\", the comment configured on the matching firewall policy is added to traffic log entries. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"neighborEvent":{"name":"neighborEvent","type":"\u0007","is_mandatory":true,"title":"Whether neighbor discovery events are logged","desc":"When \"enable\", link-layer neighbor information events (ARP/neighbor table changes) are recorded. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"resolveIp":{"name":"resolveIp","type":"\u0007","is_mandatory":true,"title":"Whether resolved domain names appear in traffic logs","desc":"When \"enable\", IP addresses in traffic logs are annotated with their resolved host names. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"resolvePort":{"name":"resolvePort","type":"\u0007","is_mandatory":true,"title":"Whether resolved service/port names appear in traffic logs","desc":"When \"enable\", port numbers in traffic logs are annotated with their well-known service names. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"userAnonymize":{"name":"userAnonymize","type":"\u0007","is_mandatory":true,"title":"Whether user names are anonymized in log messages","desc":"When \"enable\", user identities in log records are obscured for privacy. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS global log settings","desc":"Device-wide logging behavior from `config log setting`: which traffic classes are logged, how log records are formatted, and privacy controls. These settings determine whether implicit-deny hits, local-in traffic (to the device itself), and local-out traffic (originated by the device) are recorded, which is central to auditing log coverage for incident response.","defaults":"fwpolicyImplicitLog resolveIp","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.log.syslog":{"id":"fortios.log.syslog","name":"fortios.log.syslog","fields":{"facility":{"name":"facility","type":"\u0007","is_mandatory":true,"title":"Syslog facility used to tag forwarded messages","desc":"One of kernel, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, ntp, audit, alert, clock, local0, local1, local2, local3, local4, local5, local6, or local7. Defaults to local7.","provider":"go.mondoo.com/cnquery/providers/fortios"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Syslog record format","desc":"One of \"default\" (standard syslog key-value), \"csv\" (comma-separated values), \"cef\" (ArcSight Common Event Format), or \"rfc5424\" (structured RFC 5424 syslog). Newer FortiOS releases add \"json\" and a \"custom\" template format.","provider":"go.mondoo.com/cnquery/providers/fortios"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Syslog transport mode","desc":"One of \"udp\" (plain UDP, no delivery guarantee), \"legacy-reliable\" (RFC 3195 reliable syslog over TCP), or \"reliable\" (reliable syslog over TCP per RFC 6587). Both reliable modes run over TCP so log records survive transient loss.","provider":"go.mondoo.com/cnquery/providers/fortios"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Destination TCP/UDP port on the syslog server","desc":"Defaults to 514. TCP is used for the reliable modes and UDP for \"udp\" mode.","provider":"go.mondoo.com/cnquery/providers/fortios"},"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"Remote syslog server hostname or IP address","provider":"go.mondoo.com/cnquery/providers/fortios"},"sourceIp":{"name":"sourceIp","type":"\u0007","is_mandatory":true,"title":"Source IP address used for outgoing syslog messages","desc":"Pins the source address of syslog traffic to a specific interface IP. Empty when the device selects the source by route.","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether syslog forwarding is enabled","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"Remote syslog server logging settings","desc":"Global configuration for forwarding logs to a remote syslog server, read from `config log syslogd setting`: whether forwarding is on, the destination server and port, the transport mode, the syslog facility, the source IP, and the on-wire record format. Auditing these fields confirms logs are shipped off-box for retention and SIEM ingestion, and that a resilient transport is used where required. This reflects only the primary syslog target; FortiOS also supports syslogd2/3/4 targets that are not surfaced here.","defaults":"status server","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.network":{"id":"fortios.network","name":"fortios.network","fields":{"interface":{"name":"interface","type":"\u001bfortios.network.interface","title":"FortiOS network interface","desc":"A single physical or virtual interface from `config system interface`. The `name` field selects the interface, for example `fortios.network.interface(name: \"port1\")`. The `allowaccess` field is a key hardening target because it lists which management services (ping, HTTPS, SSH, and so on) are reachable on the interface, and `role` distinguishes WAN-facing from internal ports, so a common finding is management access enabled on a WAN interface.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bfortios.network.interface","title":"Network interfaces (physical and virtual) from config system interface","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS network configuration","desc":"Root of the device's interface model, backed by `config system interface` in the FortiOS configuration database. The `interfaces` field enumerates every physical and virtual interface, the starting point for auditing addressing, permitted management access, VDOM membership, and interface roles.","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.network.interface":{"id":"fortios.network.interface","name":"fortios.network.interface","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Friendly alias for the interface","desc":"Empty when no alias is configured.","provider":"go.mondoo.com/cnquery/providers/fortios"},"allowaccess":{"name":"allowaccess","type":"\u0007","is_mandatory":true,"title":"Management services permitted on the interface","desc":"Space-separated list, for example \"ping https ssh\". Possible tokens include ping, https, http, ssh, telnet, snmp, fgfm (FortiManager), fabric, radius-acct, probe-response, ftm, and speed-test. Exposing management services (especially http, telnet, or ssh on WAN interfaces) is a common hardening finding.","provider":"go.mondoo.com/cnquery/providers/fortios"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the interface","provider":"go.mondoo.com/cnquery/providers/fortios"},"ip":{"name":"ip","type":"\u0007","is_mandatory":true,"title":"IP address and subnet mask assigned to the interface","desc":"Space-separated \"address netmask\", for example \"192.168.1.99 255.255.255.0\". \"0.0.0.0 0.0.0.0\" when the interface has no static address (DHCP/PPPoE learned, or unnumbered).","provider":"go.mondoo.com/cnquery/providers/fortios"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Addressing mode","desc":"One of \"static\", \"dhcp\", or \"pppoe\". \"static\" uses the configured ip; \"dhcp\" and \"pppoe\" learn addressing dynamically.","provider":"go.mondoo.com/cnquery/providers/fortios"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"Maximum transmission unit (MTU), in bytes","desc":"Reflects a manual override only when MTU override is enabled; otherwise the interface default (typically 1500).","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name (for example \"port1\" or \"wan1\")","provider":"go.mondoo.com/cnquery/providers/fortios"},"parentInterface":{"name":"parentInterface","type":"\u0007","is_mandatory":true,"title":"Parent interface name, for VLAN sub-interfaces","desc":"The physical or aggregate interface a VLAN is built on (sourced from the interface field). Empty when the interface has no parent.","provider":"go.mondoo.com/cnquery/providers/fortios"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Interface role","desc":"One of \"lan\", \"wan\", \"dmz\", or \"undefined\". Purely descriptive but widely used to scope hardening checks (for example flagging management access on \"wan\" interfaces).","provider":"go.mondoo.com/cnquery/providers/fortios"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"Configured link speed and duplex setting","desc":"One of \"auto\", \"10full\", \"10half\", \"100full\", \"100half\", \"1000full\", \"1000half\", or \"1000auto\". \"auto\" negotiates speed and duplex.","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Administrative status of the interface","desc":"One of \"up\" or \"down\". This is the configured admin state, not the live link state.","provider":"go.mondoo.com/cnquery/providers/fortios"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Interface type","desc":"For example \"physical\", \"vlan\", \"aggregate\", \"redundant\", \"tunnel\", \"loopback\", \"vdom-link\", \"switch\", \"hard-switch\", \"vap-switch\", \"wl-mesh\", \"vxlan\", \"geneve\", or \"emac-vlan\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"vdom":{"name":"vdom","type":"\u0007","is_mandatory":true,"title":"Virtual domain (VDOM) the interface belongs to","desc":"\"root\" on single-VDOM devices.","provider":"go.mondoo.com/cnquery/providers/fortios"},"vlanid":{"name":"vlanid","type":"\u0005","is_mandatory":true,"title":"VLAN ID, for VLAN interfaces","desc":"1-4094 for a VLAN sub-interface. 0 when the interface is not a VLAN interface.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"FortiOS network interface","desc":"A single physical or virtual interface from `config system interface`. The `name` field selects the interface, for example `fortios.network.interface(name: \"port1\")`. The `allowaccess` field is a key hardening target because it lists which management services (ping, HTTPS, SSH, and so on) are reachable on the interface, and `role` distinguishes WAN-facing from internal ports, so a common finding is management access enabled on a WAN interface.","private":true,"defaults":"name ip type","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router":{"id":"fortios.router","name":"fortios.router","fields":{"bgp":{"name":"bgp","type":"\u001bfortios.router.bgp","title":"BGP dynamic-routing configuration","provider":"go.mondoo.com/cnquery/providers/fortios"},"ospf":{"name":"ospf","type":"\u001bfortios.router.ospf","title":"OSPF dynamic-routing configuration","provider":"go.mondoo.com/cnquery/providers/fortios"},"policies":{"name":"policies","type":"\u0019\u001bfortios.router.policy","title":"Policy-based routes","desc":"Source, service, and protocol based routing rules from `config router policy`, evaluated ahead of the destination-based routing table.","provider":"go.mondoo.com/cnquery/providers/fortios"},"policy":{"name":"policy","type":"\u001bfortios.router.policy","title":"FortiOS policy-based route","desc":"A single entry from `config router policy` that forwards traffic based on a combination of source, destination, protocol, and ports rather than the destination address alone. The `seqNum` field is the unique sequence number that selects the entry, for example `fortios.router.policy(seqNum: 1)`. Policy routes (PBR) are evaluated in sequence-number order and take precedence over the regular FIB, so they are where you audit traffic that is deliberately steered around normal routing (for example forcing a subnet out a specific WAN or a particular next hop).","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"staticRoute":{"name":"staticRoute","type":"\u001bfortios.router.staticRoute","title":"IPv4 static route","desc":"A single static routing entry from `config router static`. The `seqNum` field is the unique sequence number that selects the route, for example `fortios.router.staticRoute(seqNum: 1)`. A destination of `0.0.0.0/0` is the default route, and a `blackhole` route silently drops matching traffic instead of forwarding it.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"staticRoutes":{"name":"staticRoutes","type":"\u0019\u001bfortios.router.staticRoute","title":"Static routes configured on the device","desc":"IPv4 static routes from `config router static`, each keyed by its sequence number.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"Router configuration","desc":"Device routing configuration surfaced from the FortiOS router CMDB. Static routes are available through `staticRoutes`, dynamic routing through `bgp` and `ospf`, and policy-based routing through `policies`. It audits how the device forwards traffic, including default routes, blackhole entries, and the peering topology of dynamic protocols.","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.bgp":{"id":"fortios.router.bgp","name":"fortios.router.bgp","fields":{"as":{"name":"as","type":"\u0005","is_mandatory":true,"title":"Local autonomous system (AS) number","provider":"go.mondoo.com/cnquery/providers/fortios"},"ebgpMultipath":{"name":"ebgpMultipath","type":"\u0007","is_mandatory":true,"title":"Whether EBGP multipath load-sharing is enabled","desc":"One of \"enable\" or \"disable\". Allows installing multiple equal-cost paths learned from external peers.","provider":"go.mondoo.com/cnquery/providers/fortios"},"gracefulRestart":{"name":"gracefulRestart","type":"\u0007","is_mandatory":true,"title":"Whether BGP graceful restart is enabled","desc":"One of \"enable\" or \"disable\". Preserves forwarding while the BGP control plane restarts.","provider":"go.mondoo.com/cnquery/providers/fortios"},"gracefulRestartTime":{"name":"gracefulRestartTime","type":"\u0005","is_mandatory":true,"title":"Graceful restart timer, in seconds","desc":"Maximum time the peer waits for the restarting router to re-establish the session.","provider":"go.mondoo.com/cnquery/providers/fortios"},"gracefulStalepathTime":{"name":"gracefulStalepathTime","type":"\u0005","is_mandatory":true,"title":"Graceful stalepath timer, in seconds","desc":"How long stale routes from a restarting peer are retained before being flushed.","provider":"go.mondoo.com/cnquery/providers/fortios"},"holdtimeTimer":{"name":"holdtimeTimer","type":"\u0005","is_mandatory":true,"title":"Hold timer, in seconds","desc":"Time to wait for keepalives before declaring a peer down; the default is 180.","provider":"go.mondoo.com/cnquery/providers/fortios"},"keepaliveTimer":{"name":"keepaliveTimer","type":"\u0005","is_mandatory":true,"title":"Keepalive timer, in seconds","desc":"Interval between keepalive messages, typically one third of the hold time; the default is 60.","provider":"go.mondoo.com/cnquery/providers/fortios"},"logNeighbourChanges":{"name":"logNeighbourChanges","type":"\u0007","is_mandatory":true,"title":"Whether BGP neighbor state changes are logged","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"neighbor":{"name":"neighbor","type":"\u001bfortios.router.bgp.neighbor","title":"BGP neighbor","desc":"A single BGP peer from the `neighbor` table of `config router bgp`. The `ip` field is the peer address and selects the entry, for example `fortios.router.bgp.neighbor(ip: \"10.0.0.1\")`. Its fields describe the remote AS, per-peer timers, BFD, route-map filtering, and whether the session is administratively shut down.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"neighbors":{"name":"neighbors","type":"\u0019\u001bfortios.router.bgp.neighbor","is_mandatory":true,"title":"Configured BGP peers","provider":"go.mondoo.com/cnquery/providers/fortios"},"routerId":{"name":"routerId","type":"\u0007","is_mandatory":true,"title":"BGP router ID","desc":"IPv4-formatted identifier for the BGP process, unique within the routing domain.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"BGP routing configuration","desc":"Border Gateway Protocol settings from `config router bgp`: the local AS number and router ID, EBGP multipath and graceful-restart behavior, global timers, and the configured peers exposed through `neighbors`. Auditing BGP surfaces peering relationships, timer hardening, and whether neighbor state changes are being logged for change detection.","defaults":"as routerId","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.bgp.neighbor":{"id":"fortios.router.bgp.neighbor","name":"fortios.router.bgp.neighbor","fields":{"bfd":{"name":"bfd","type":"\u0007","is_mandatory":true,"title":"Whether Bidirectional Forwarding Detection (BFD) is enabled","desc":"One of \"enable\" or \"disable\". BFD gives sub-second failure detection for the peer.","provider":"go.mondoo.com/cnquery/providers/fortios"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the neighbor","provider":"go.mondoo.com/cnquery/providers/fortios"},"holdtimeTimer":{"name":"holdtimeTimer","type":"\u0005","is_mandatory":true,"title":"Per-neighbor hold timer, in seconds","desc":"Overrides the global BGP hold time for this peer.","provider":"go.mondoo.com/cnquery/providers/fortios"},"ip":{"name":"ip","type":"\u0007","is_mandatory":true,"title":"Peer IP address","provider":"go.mondoo.com/cnquery/providers/fortios"},"keepaliveTimer":{"name":"keepaliveTimer","type":"\u0005","is_mandatory":true,"title":"Per-neighbor keepalive timer, in seconds","desc":"Overrides the global BGP keepalive interval for this peer.","provider":"go.mondoo.com/cnquery/providers/fortios"},"remoteAs":{"name":"remoteAs","type":"\u0005","is_mandatory":true,"title":"Remote peer's autonomous system (AS) number","desc":"Equal to the local AS for an IBGP peer, different for an EBGP peer.","provider":"go.mondoo.com/cnquery/providers/fortios"},"routeMapIn":{"name":"routeMapIn","type":"\u0007","is_mandatory":true,"title":"Route map applied to routes received from the neighbor","desc":"Name of the inbound route map; empty when no filter is applied.","provider":"go.mondoo.com/cnquery/providers/fortios"},"routeMapOut":{"name":"routeMapOut","type":"\u0007","is_mandatory":true,"title":"Route map applied to routes advertised to the neighbor","desc":"Name of the outbound route map; empty when no filter is applied.","provider":"go.mondoo.com/cnquery/providers/fortios"},"shutdown":{"name":"shutdown","type":"\u0007","is_mandatory":true,"title":"Whether the neighbor session is administratively shut down","desc":"One of \"enable\" or \"disable\"; \"enable\" means the session is held down and no routes are exchanged.","provider":"go.mondoo.com/cnquery/providers/fortios"},"softReconfiguration":{"name":"softReconfiguration","type":"\u0007","is_mandatory":true,"title":"Whether inbound soft reconfiguration is enabled","desc":"One of \"enable\" or \"disable\". Stores received routes so inbound policy can be reapplied without resetting the session.","provider":"go.mondoo.com/cnquery/providers/fortios"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Route-selection weight applied to routes from this neighbor","desc":"Higher weight makes routes from this peer more preferred; the weight is local to this device and not advertised.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"ip","type":"\u0007"}]},"title":"BGP neighbor","desc":"A single BGP peer from the `neighbor` table of `config router bgp`. The `ip` field is the peer address and selects the entry, for example `fortios.router.bgp.neighbor(ip: \"10.0.0.1\")`. Its fields describe the remote AS, per-peer timers, BFD, route-map filtering, and whether the session is administratively shut down.","private":true,"defaults":"ip remoteAs","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.ospf":{"id":"fortios.router.ospf","name":"fortios.router.ospf","fields":{"area":{"name":"area","type":"\u001bfortios.router.ospf.area","title":"OSPF area","desc":"A single OSPF area from the `area` table of `config router ospf`. The `id` field is the area identifier in dotted-decimal notation and selects the entry, for example `fortios.router.ospf.area(id: \"0.0.0.0\")` for the backbone. The `type` distinguishes regular, stub, and NSSA areas, which control how external routes propagate.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"areas":{"name":"areas","type":"\u0019\u001bfortios.router.ospf.area","is_mandatory":true,"title":"Configured OSPF areas","provider":"go.mondoo.com/cnquery/providers/fortios"},"autoCostRefBandwidth":{"name":"autoCostRefBandwidth","type":"\u0005","is_mandatory":true,"title":"Reference bandwidth for auto-cost calculation, in Mbps","desc":"Interface cost is reference bandwidth divided by interface bandwidth; the default is 1000.","provider":"go.mondoo.com/cnquery/providers/fortios"},"defaultInformationMetric":{"name":"defaultInformationMetric","type":"\u0005","is_mandatory":true,"title":"Metric assigned to the originated default route","provider":"go.mondoo.com/cnquery/providers/fortios"},"defaultInformationMetricType":{"name":"defaultInformationMetricType","type":"\u0007","is_mandatory":true,"title":"Metric type for the originated default route","desc":"One of \"1\" (external type-1: external cost plus the internal cost to the ASBR) or \"2\" (external type-2: the external cost only, which is the default).","provider":"go.mondoo.com/cnquery/providers/fortios"},"defaultInformationOriginate":{"name":"defaultInformationOriginate","type":"\u0007","is_mandatory":true,"title":"Whether the device originates a default route into OSPF","desc":"One of \"enable\" (originate a default only when one exists in the routing table), \"always\" (originate unconditionally), or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"defaultInformationRouteMap":{"name":"defaultInformationRouteMap","type":"\u0007","is_mandatory":true,"title":"Route map controlling default-route origination","desc":"Name of the route map that gates when the default is originated; empty when none is set.","provider":"go.mondoo.com/cnquery/providers/fortios"},"defaultMetric":{"name":"defaultMetric","type":"\u0005","is_mandatory":true,"title":"Default metric applied to redistributed routes","provider":"go.mondoo.com/cnquery/providers/fortios"},"logNeighbourChanges":{"name":"logNeighbourChanges","type":"\u0007","is_mandatory":true,"title":"Whether OSPF neighbor state changes are logged","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"routerId":{"name":"routerId","type":"\u0007","is_mandatory":true,"title":"OSPF router ID","desc":"IPv4-formatted identifier for the OSPF process, unique within the routing domain.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"OSPF routing configuration","desc":"Open Shortest Path First settings from `config router ospf`: the router ID, default-route origination and metric behavior, the reference bandwidth for automatic cost calculation, and the configured areas exposed through `areas`. Auditing OSPF surfaces the area topology and whether adjacency changes are logged.","defaults":"routerId","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.ospf.area":{"id":"fortios.router.ospf.area","name":"fortios.router.ospf.area","fields":{"defaultCost":{"name":"defaultCost","type":"\u0005","is_mandatory":true,"title":"Default cost advertised into a stub or NSSA area","desc":"Cost of the default route the ABR injects into the area; ignored for a regular area.","provider":"go.mondoo.com/cnquery/providers/fortios"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Area identifier in dotted-decimal notation (for example \"0.0.0.0\")","provider":"go.mondoo.com/cnquery/providers/fortios"},"shortcut":{"name":"shortcut","type":"\u0007","is_mandatory":true,"title":"Whether area shortcuts are enabled","desc":"One of \"disable\", \"enable\", or \"default\" (follow the area shortcut setting configured for the OSPF instance).","provider":"go.mondoo.com/cnquery/providers/fortios"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Area type","desc":"One of \"regular\" (normal area carrying all LSA types), \"stub\" (no external LSAs, a default route is injected instead), or \"nssa\" (not-so-stubby area that can import limited external routes as type-7 LSAs).","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"OSPF area","desc":"A single OSPF area from the `area` table of `config router ospf`. The `id` field is the area identifier in dotted-decimal notation and selects the entry, for example `fortios.router.ospf.area(id: \"0.0.0.0\")` for the backbone. The `type` distinguishes regular, stub, and NSSA areas, which control how external routes propagate.","private":true,"defaults":"id","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.policy":{"id":"fortios.router.policy","name":"fortios.router.policy","fields":{"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Free-form comments on the policy route","provider":"go.mondoo.com/cnquery/providers/fortios"},"dstPortEnd":{"name":"dstPortEnd","type":"\u0005","is_mandatory":true,"title":"End of the destination port range matched by the policy","desc":"Meaningful only when protocol is TCP (6) or UDP (17). Sourced from the end-port field.","provider":"go.mondoo.com/cnquery/providers/fortios"},"dstPortStart":{"name":"dstPortStart","type":"\u0005","is_mandatory":true,"title":"Start of the destination port range matched by the policy","desc":"Meaningful only when protocol is TCP (6) or UDP (17). Sourced from the start-port field.","provider":"go.mondoo.com/cnquery/providers/fortios"},"dstaddr":{"name":"dstaddr","type":"\u0019\u0007","is_mandatory":true,"title":"Destination address prefixes matched by the policy","desc":"List of IP/netmask entries. An empty list matches any destination.","provider":"go.mondoo.com/cnquery/providers/fortios"},"gateway":{"name":"gateway","type":"\u0007","is_mandatory":true,"title":"Next-hop gateway address for matching traffic","desc":"IPv4 address of the next hop. \"0.0.0.0\" when no explicit gateway is set (the packet is routed out outputDevice using its connected route).","provider":"go.mondoo.com/cnquery/providers/fortios"},"outputDevice":{"name":"outputDevice","type":"\u0007","is_mandatory":true,"title":"Outgoing interface for matching traffic","desc":"Name of the interface that matching traffic is forwarded out of.","provider":"go.mondoo.com/cnquery/providers/fortios"},"protocol":{"name":"protocol","type":"\u0005","is_mandatory":true,"title":"IP protocol number matched by the policy (0-255)","desc":"0 matches any protocol; 6 is TCP, 17 is UDP, 1 is ICMP. When 6 or 17, the source and destination port ranges further narrow the match.","provider":"go.mondoo.com/cnquery/providers/fortios"},"seqNum":{"name":"seqNum","type":"\u0005","is_mandatory":true,"title":"Sequence number that uniquely identifies the policy route and sets its evaluation order (lower numbers match first)","provider":"go.mondoo.com/cnquery/providers/fortios"},"srcPortEnd":{"name":"srcPortEnd","type":"\u0005","is_mandatory":true,"title":"End of the source port range matched by the policy","desc":"Meaningful only when protocol is TCP (6) or UDP (17). Sourced from the end-source-port field.","provider":"go.mondoo.com/cnquery/providers/fortios"},"srcPortStart":{"name":"srcPortStart","type":"\u0005","is_mandatory":true,"title":"Start of the source port range matched by the policy","desc":"Meaningful only when protocol is TCP (6) or UDP (17). Sourced from the start-source-port field.","provider":"go.mondoo.com/cnquery/providers/fortios"},"srcaddr":{"name":"srcaddr","type":"\u0019\u0007","is_mandatory":true,"title":"Source address prefixes matched by the policy","desc":"List of IP/netmask entries (for example \"10.0.0.0/8\"). An empty list matches any source.","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the policy route is enabled","desc":"One of \"enable\" or \"disable\". A disabled entry is skipped during policy-route lookup.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"seqNum","type":"\u0005"}]},"title":"FortiOS policy-based route","desc":"A single entry from `config router policy` that forwards traffic based on a combination of source, destination, protocol, and ports rather than the destination address alone. The `seqNum` field is the unique sequence number that selects the entry, for example `fortios.router.policy(seqNum: 1)`. Policy routes (PBR) are evaluated in sequence-number order and take precedence over the regular FIB, so they are where you audit traffic that is deliberately steered around normal routing (for example forcing a subnet out a specific WAN or a particular next hop).","private":true,"defaults":"seqNum","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.router.staticRoute":{"id":"fortios.router.staticRoute","name":"fortios.router.staticRoute","fields":{"blackhole":{"name":"blackhole","type":"\u0007","is_mandatory":true,"title":"Whether this is a blackhole route that silently drops traffic","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment on the route","provider":"go.mondoo.com/cnquery/providers/fortios"},"device":{"name":"device","type":"\u0007","is_mandatory":true,"title":"Outgoing interface name for the route","provider":"go.mondoo.com/cnquery/providers/fortios"},"distance":{"name":"distance","type":"\u0005","is_mandatory":true,"title":"Administrative distance used to rank this route","desc":"Ranges from 1 to 255; lower values are preferred when multiple routes reach the same destination. The default is 10.","provider":"go.mondoo.com/cnquery/providers/fortios"},"dst":{"name":"dst","type":"\u0007","is_mandatory":true,"title":"Destination subnet in CIDR notation","desc":"For example \"10.0.0.0/8\", or \"0.0.0.0/0\" for the default route.","provider":"go.mondoo.com/cnquery/providers/fortios"},"gateway":{"name":"gateway","type":"\u0007","is_mandatory":true,"title":"Next-hop gateway IP address","desc":"Empty for a blackhole route or a route bound directly to an interface with no next hop.","provider":"go.mondoo.com/cnquery/providers/fortios"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Route priority within the same administrative distance","desc":"Ranges from 0 to 4294967295; the lowest priority wins when distance and cost tie.","provider":"go.mondoo.com/cnquery/providers/fortios"},"seqNum":{"name":"seqNum","type":"\u0005","is_mandatory":true,"title":"Sequence number that uniquely identifies the route","provider":"go.mondoo.com/cnquery/providers/fortios"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the route is enabled","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Route weight used for load distribution","desc":"Ranges from 0 to 255; a higher weight makes the route more preferred.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"seqNum","type":"\u0005"}]},"title":"IPv4 static route","desc":"A single static routing entry from `config router static`. The `seqNum` field is the unique sequence number that selects the route, for example `fortios.router.staticRoute(seqNum: 1)`. A destination of `0.0.0.0/0` is the default route, and a `blackhole` route silently drops matching traffic instead of forwarding it.","private":true,"defaults":"seqNum dst gateway","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system":{"id":"fortios.system","fields":{"dns":{"name":"dns","type":"\u001bfortios.system.dns","title":"FortiOS DNS settings","desc":"Resolver configuration from `config system dns` that the device uses for its own DNS lookups: the primary and secondary server addresses and whether outbound DNS queries are protected with DNS-over-TLS.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"firmware":{"name":"firmware","type":"\u001bfortios.system.firmware","title":"FortiOS firmware inventory","desc":"Firmware running on the device and the images available to it, as reported by the `/api/v2/monitor/system/firmware` endpoint. The `current` field holds the version currently booted, while `available` lists every firmware image FortiGuard offers this hardware model as an upgrade or downgrade target. Compare `current.version` against the available images (and their maturity) to audit whether the device runs an outdated, feature, or end-of-support release.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"fortiGuard":{"name":"fortiGuard","type":"\u001bfortios.system.fortiGuard","title":"FortiGuard subscription and update settings","desc":"FortiGuard service licensing and signature-update configuration, read from `config system fortiguard`. The `*License` fields report the subscription state for each security service (0 means no license, a nonzero code indicates an active subscription), the `*Expiration` fields give the definition-expiry timestamps, and the update-server fields control how the device retrieves signature updates. Auditing these surfaces expired or missing security subscriptions that would leave antispam, web filtering, or outbreak prevention running on stale definitions.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"global":{"name":"global","type":"\u001bfortios.system.global","title":"FortiOS global system settings","desc":"Device-wide administrative settings from `config system global`: identity (hostname, timezone), the ports admin access listens on, and admin session controls. The `admintimeout` idle-logout value and the `adminScp` config-transfer toggle are common hardening-audit targets, as are the admin HTTPS (`adminSport`) and SSH (`adminSshPort`) ports, often checked against a required non-default value.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"ha":{"name":"ha","type":"\u001bfortios.system.ha","title":"FortiOS high-availability configuration","desc":"Clustering settings from `config system ha` that control failover between FortiGate units. The `mode` field distinguishes a standalone device from an active-active or active-passive cluster, and the remaining fields describe cluster identity (`groupId`, `groupName`), member `priority` and `override`, the heartbeat links (`hbdev`), session synchronization (`sessionPickup`), and the active-active load-balancing `schedule`.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"ntp":{"name":"ntp","type":"\u001bfortios.system.ntp","title":"FortiOS NTP settings","desc":"Time-synchronization configuration from `config system ntp`. The `type` field selects between Fortinet's FortiGuard time servers and a custom server list, and `servers` enumerates the configured custom NTP servers. Accurate time is a prerequisite for trustworthy logs and certificate validation.","provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true}},"is_extension":true},"fortios.system.dns":{"id":"fortios.system.dns","name":"fortios.system.dns","fields":{"dnsOverTls":{"name":"dnsOverTls","type":"\u0007","is_mandatory":true,"title":"DNS-over-TLS mode","desc":"One of \"disable\" (plaintext DNS), \"enable\" (use TLS when available, falling back to plaintext), or \"enforce\" (use only TLS and never fall back to unencrypted queries). On FortiOS 8.0 and later this control is replaced by a `protocol` setting (cleartext/dot/doh).","provider":"go.mondoo.com/cnquery/providers/fortios"},"primary":{"name":"primary","type":"\u0007","is_mandatory":true,"title":"Primary DNS server IP address","provider":"go.mondoo.com/cnquery/providers/fortios"},"secondary":{"name":"secondary","type":"\u0007","is_mandatory":true,"title":"Secondary DNS server IP address","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS DNS settings","desc":"Resolver configuration from `config system dns` that the device uses for its own DNS lookups: the primary and secondary server addresses and whether outbound DNS queries are protected with DNS-over-TLS.","defaults":"primary secondary","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.firmware":{"id":"fortios.system.firmware","name":"fortios.system.firmware","fields":{"available":{"name":"available","type":"\u0019\u001bfortios.system.firmware.versionInfo","is_mandatory":true,"title":"Firmware images available to install on this device","desc":"Every version the device could upgrade or downgrade to, as reported by FortiGuard for this hardware model. Empty when the device cannot reach FortiGuard or has no alternate images.","provider":"go.mondoo.com/cnquery/providers/fortios"},"current":{"name":"current","type":"\u001bfortios.system.firmware.versionInfo","is_mandatory":true,"title":"Firmware image the device is currently running","provider":"go.mondoo.com/cnquery/providers/fortios"},"versionInfo":{"name":"versionInfo","type":"\u001bfortios.system.firmware.versionInfo","title":"FortiOS firmware version details","desc":"Version, build, and release metadata for a single firmware image. The `id` field is either the literal `current` (for the running image) or the FortiGuard image identifier such as `07006000FIMG0022106003`. Together the `major`, `minor`, `patch`, and `build` fields give the fully qualified release, and `maturity` distinguishes a feature build from a mature (long-lived) build.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true}},"title":"FortiOS firmware inventory","desc":"Firmware running on the device and the images available to it, as reported by the `/api/v2/monitor/system/firmware` endpoint. The `current` field holds the version currently booted, while `available` lists every firmware image FortiGuard offers this hardware model as an upgrade or downgrade target. Compare `current.version` against the available images (and their maturity) to audit whether the device runs an outdated, feature, or end-of-support release.","defaults":"current.version current.build","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.firmware.versionInfo":{"id":"fortios.system.firmware.versionInfo","name":"fortios.system.firmware.versionInfo","fields":{"branchPoint":{"name":"branchPoint","type":"\u0005","is_mandatory":true,"title":"Branch point build number the release was forked from","desc":"Build number of the common ancestor the release branched from. Zero when not reported.","provider":"go.mondoo.com/cnquery/providers/fortios"},"build":{"name":"build","type":"\u0005","is_mandatory":true,"title":"Build number of the firmware image","desc":"FortiGuard build number identifying the exact compiled image within a release (for example 3306). Distinguishes rebuilds of the same major.minor.patch version.","provider":"go.mondoo.com/cnquery/providers/fortios"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image identifier, or the literal \"current\" for the running image","desc":"The FortiGuard image ID for an available image (for example `07006000FIMG0022106003`), or `current` when this entry describes the firmware the device is currently running.","provider":"go.mondoo.com/cnquery/providers/fortios"},"major":{"name":"major","type":"\u0005","is_mandatory":true,"title":"Major component of the version (the 7 in v7.6.4)","provider":"go.mondoo.com/cnquery/providers/fortios"},"maturity":{"name":"maturity","type":"\u0007","is_mandatory":true,"title":"Release maturity code","desc":"Single-letter FortiGuard code: \"F\" for a Feature release (newest capabilities, shorter support) or \"M\" for a Mature release (stability focused, longer support). Empty when not reported.","provider":"go.mondoo.com/cnquery/providers/fortios"},"minor":{"name":"minor","type":"\u0005","is_mandatory":true,"title":"Minor component of the version (the 6 in v7.6.4)","provider":"go.mondoo.com/cnquery/providers/fortios"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Short OS product name, for example \"FortiOS\"","provider":"go.mondoo.com/cnquery/providers/fortios"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Free-form release notes for the image","desc":"Release-note text supplied by FortiGuard for the image. Empty when none is provided.","provider":"go.mondoo.com/cnquery/providers/fortios"},"patch":{"name":"patch","type":"\u0005","is_mandatory":true,"title":"Patch component of the version (the 4 in v7.6.4)","provider":"go.mondoo.com/cnquery/providers/fortios"},"platformId":{"name":"platformId","type":"\u0007","is_mandatory":true,"title":"Hardware platform identifier this image targets","desc":"FortiGate hardware model code the image is built for, for example `FGVMGC` (FortiGate VM). Populated only for the \"current\" version entry; empty for available images.","provider":"go.mondoo.com/cnquery/providers/fortios"},"releaseType":{"name":"releaseType","type":"\u0007","is_mandatory":true,"title":"Release type reported by FortiGuard","desc":"FortiGuard classification string for the image. Empty when not reported.","provider":"go.mondoo.com/cnquery/providers/fortios"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source of the firmware image record","desc":"Origin of this version entry as reported by the device, for example where the image listing came from. Empty when not reported.","provider":"go.mondoo.com/cnquery/providers/fortios"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Semantic version string of the firmware, for example \"v7.6.4\"","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS firmware version details","desc":"Version, build, and release metadata for a single firmware image. The `id` field is either the literal `current` (for the running image) or the FortiGuard image identifier such as `07006000FIMG0022106003`. Together the `major`, `minor`, `patch`, and `build` fields give the fully qualified release, and `maturity` distinguishes a feature build from a mature (long-lived) build.","private":true,"defaults":"id version build","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.fortiGuard":{"id":"fortios.system.fortiGuard","name":"fortios.system.fortiGuard","fields":{"antispamExpiration":{"name":"antispamExpiration","type":"\u0005","is_mandatory":true,"title":"Antispam definition expiration, as Unix epoch seconds","provider":"go.mondoo.com/cnquery/providers/fortios"},"antispamLicense":{"name":"antispamLicense","type":"\u0005","is_mandatory":true,"title":"Antispam license state","desc":"FortiGuard license type code for the antispam service; 0 means no license, a nonzero value indicates an active subscription.","provider":"go.mondoo.com/cnquery/providers/fortios"},"autoJoinForticloud":{"name":"autoJoinForticloud","type":"\u0007","is_mandatory":true,"title":"Whether the device auto-joins FortiCloud","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"outbreakPreventionExpiration":{"name":"outbreakPreventionExpiration","type":"\u0005","is_mandatory":true,"title":"Outbreak prevention definition expiration, as Unix epoch seconds","provider":"go.mondoo.com/cnquery/providers/fortios"},"outbreakPreventionLicense":{"name":"outbreakPreventionLicense","type":"\u0005","is_mandatory":true,"title":"Outbreak prevention license state","desc":"FortiGuard license type code for the outbreak-prevention service; 0 means no license, a nonzero value indicates an active subscription.","provider":"go.mondoo.com/cnquery/providers/fortios"},"updateServerLocation":{"name":"updateServerLocation","type":"\u0007","is_mandatory":true,"title":"FortiGuard update server region","desc":"Region the device uses to reach FortiGuard update servers: \"usa\" (US only), \"eu\" (EU only), or \"any\" (lowest-latency location, shown as \"automatic\" in FortiOS 7.4 and later). The default is \"any\" on hardware appliances and \"usa\" on VM images.","provider":"go.mondoo.com/cnquery/providers/fortios"},"webfilterExpiration":{"name":"webfilterExpiration","type":"\u0005","is_mandatory":true,"title":"Web filter definition expiration, as Unix epoch seconds","provider":"go.mondoo.com/cnquery/providers/fortios"},"webfilterLicense":{"name":"webfilterLicense","type":"\u0005","is_mandatory":true,"title":"Web filter license state","desc":"FortiGuard license type code for the web-filtering service; 0 means no license, a nonzero value indicates an active subscription.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiGuard subscription and update settings","desc":"FortiGuard service licensing and signature-update configuration, read from `config system fortiguard`. The `*License` fields report the subscription state for each security service (0 means no license, a nonzero code indicates an active subscription), the `*Expiration` fields give the definition-expiry timestamps, and the update-server fields control how the device retrieves signature updates. Auditing these surfaces expired or missing security subscriptions that would leave antispam, web filtering, or outbreak prevention running on stale definitions.","defaults":"antispamLicense webfilterLicense outbreakPreventionLicense","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.global":{"id":"fortios.system.global","name":"fortios.system.global","fields":{"adminScp":{"name":"adminScp","type":"\u0007","is_mandatory":true,"title":"Whether SCP access to the admin interface is enabled","desc":"When \"enable\", the device permits downloading the running configuration over SCP (SSH). One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"adminSport":{"name":"adminSport","type":"\u0005","is_mandatory":true,"title":"TCP port for the HTTPS administrative interface","desc":"Port the admin GUI/HTTPS management service listens on (FortiOS default 443).","provider":"go.mondoo.com/cnquery/providers/fortios"},"adminSshPort":{"name":"adminSshPort","type":"\u0005","is_mandatory":true,"title":"TCP port for administrative SSH access","desc":"Port the admin SSH management service listens on (FortiOS default 22).","provider":"go.mondoo.com/cnquery/providers/fortios"},"admintimeout":{"name":"admintimeout","type":"\u0005","is_mandatory":true,"title":"Idle timeout for administrator sessions, in minutes","desc":"Administrators are logged out after this many minutes of inactivity (FortiOS default is 5). Lower values are commonly required by hardening baselines such as CIS.","provider":"go.mondoo.com/cnquery/providers/fortios"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Device hostname","provider":"go.mondoo.com/cnquery/providers/fortios"},"timezone":{"name":"timezone","type":"\u0007","is_mandatory":true,"title":"System timezone identifier","desc":"FortiOS timezone selector, for example \"04\" or a named zone, identifying the device's local time offset used in log timestamps.","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS global system settings","desc":"Device-wide administrative settings from `config system global`: identity (hostname, timezone), the ports admin access listens on, and admin session controls. The `admintimeout` idle-logout value and the `adminScp` config-transfer toggle are common hardening-audit targets, as are the admin HTTPS (`adminSport`) and SSH (`adminSshPort`) ports, often checked against a required non-default value.","defaults":"hostname","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.ha":{"id":"fortios.system.ha","name":"fortios.system.ha","fields":{"groupId":{"name":"groupId","type":"\u0005","is_mandatory":true,"title":"Numeric HA cluster group ID","desc":"Shared cluster identifier (0-255) that must match across all members; also derives the cluster's virtual MAC addresses.","provider":"go.mondoo.com/cnquery/providers/fortios"},"groupName":{"name":"groupName","type":"\u0007","is_mandatory":true,"title":"HA cluster group name","provider":"go.mondoo.com/cnquery/providers/fortios"},"hbdev":{"name":"hbdev","type":"\u0007","is_mandatory":true,"title":"Heartbeat interface(s) used for HA synchronization","desc":"Interface-name and heartbeat-priority pairs carrying HA heartbeat and configuration/session-sync traffic, for example `port9 50 port10 50`; the number after each interface is its heartbeat priority (higher wins).","provider":"go.mondoo.com/cnquery/providers/fortios"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"HA operating mode","desc":"One of \"standalone\" (no clustering), \"a-a\" (active-active, both units process traffic), or \"a-p\" (active-passive, one primary unit processes traffic while the secondary stands by).","provider":"go.mondoo.com/cnquery/providers/fortios"},"override":{"name":"override","type":"\u0007","is_mandatory":true,"title":"Whether HA override is enabled","desc":"When \"enable\", the configured `priority` forces primary selection immediately rather than deferring to the member with the longest uptime. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"This device's priority within the HA cluster","desc":"Higher-priority members are preferred as primary during failover negotiation (range 0-255, FortiOS default 128). Only decisive when `override` is enabled or uptimes are equal.","provider":"go.mondoo.com/cnquery/providers/fortios"},"schedule":{"name":"schedule","type":"\u0007","is_mandatory":true,"title":"Load-balancing schedule for active-active clusters","desc":"Algorithm distributing sessions across members in a-a mode. One of \"none\" (all traffic to the primary), \"hub\", \"leastconnection\" (fewest active sessions), \"round-robin\", \"weight-round-robin\" (round-robin weighted per member), \"random\", \"ip\" (by source/destination IP), or \"ipport\" (by source/destination IP and port).","provider":"go.mondoo.com/cnquery/providers/fortios"},"sessionPickup":{"name":"sessionPickup","type":"\u0007","is_mandatory":true,"title":"Whether session pickup (session synchronization) is enabled","desc":"When \"enable\", the primary continuously synchronizes its session table so established sessions survive a failover. One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS high-availability configuration","desc":"Clustering settings from `config system ha` that control failover between FortiGate units. The `mode` field distinguishes a standalone device from an active-active or active-passive cluster, and the remaining fields describe cluster identity (`groupId`, `groupName`), member `priority` and `override`, the heartbeat links (`hbdev`), session synchronization (`sessionPickup`), and the active-active load-balancing `schedule`.","defaults":"mode groupName","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.ntp":{"id":"fortios.system.ntp","name":"fortios.system.ntp","fields":{"ntpsync":{"name":"ntpsync","type":"\u0007","is_mandatory":true,"title":"Whether NTP time synchronization is enabled","desc":"One of \"enable\" or \"disable\".","provider":"go.mondoo.com/cnquery/providers/fortios"},"server":{"name":"server","type":"\u001bfortios.system.ntp.server","title":"FortiOS NTP server entry","desc":"A single configured custom NTP server. The `server` field holds its hostname or IP address and selects the entry, for example `fortios.system.ntp.server(server: \"pool.ntp.org\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/fortios","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bfortios.system.ntp.server","is_mandatory":true,"title":"Custom NTP servers configured on the device","desc":"Entries from the custom NTP server list. Populated only when `type` is \"custom\"; empty when the device uses FortiGuard time servers.","provider":"go.mondoo.com/cnquery/providers/fortios"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"NTP server source","desc":"One of \"fortiguard\" (Fortinet time servers) or \"custom\" (the servers listed in `servers`).","provider":"go.mondoo.com/cnquery/providers/fortios"}},"title":"FortiOS NTP settings","desc":"Time-synchronization configuration from `config system ntp`. The `type` field selects between Fortinet's FortiGuard time servers and a custom server list, and `servers` enumerates the configured custom NTP servers. Accurate time is a prerequisite for trustworthy logs and certificate validation.","defaults":"ntpsync type","provider":"go.mondoo.com/cnquery/providers/fortios"},"fortios.system.ntp.server":{"id":"fortios.system.ntp.server","name":"fortios.system.ntp.server","fields":{"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"NTP server hostname or IP address","provider":"go.mondoo.com/cnquery/providers/fortios"}},"init":{"args":[{"name":"server","type":"\u0007"}]},"title":"FortiOS NTP server entry","desc":"A single configured custom NTP server. The `server` field holds its hostname or IP address and selects the entry, for example `fortios.system.ntp.server(server: \"pool.ntp.org\")`.","private":true,"defaults":"server","provider":"go.mondoo.com/cnquery/providers/fortios"}}}