Release notes

0.1.0

The first release of FireSight.

Connect any number of FortiManagers (7.0 or later, API token) and standalone FortiGates (FortiOS 7.0 or later, REST API).
Sync management domains (ADOMs), firewalls, policy sets (policy packages) and their installation scope, address and service objects with groups, hit counters, routing tables (IPv4 and IPv6, with VRFs), zones, policy routes, SD-WAN zones and rules, and normalised interfaces. Policy packages in folders are supported.
Per-ADOM workspace mode detection, with an override.
Scheduled syncs (hourly by default), each followed by an audit.

Requesters describe only the traffic. FireSight traces the path firewall by firewall (policy routes, VRF routing tables, SD-WAN rules), translates interfaces into zones, SD-WAN zones and normalised interfaces, and places each policy where it takes effect.
Live pre-check of every new policy at its position.
Host names on requests, reverse-DNS names for host addresses, and optional DNS-named objects.
Requesters confirm the firewalls before submitting; plans are checked again on submit and deploy.
Manual placement (top, bottom, before or after a policy).

Named approval chains per management domain, with a standard chain as the fallback.
Conditions that add chains by address, interface or zone, port, all services, traffic from or to the internet, or management domain.
Parallel tracks, named approvers and separation of duties.
Emergency changes, approved by an emergency chain and reviewed afterwards within a deadline.
Chains can be switched off, deleted and restored.

Through FortiManager (revision, lock and commit in workspace mode, install with per-device Install On) or straight to a standalone FortiGate (configuration backup, policy added disabled and enabled once in position).
Simulation mode by default.
One-click back-out of each change, and automatic removal of temporary rules.

Findings: shadowed, redundant, crossing rules (partial overlap), never hit, inactive, disabled, too broad, not logged and best-effort, each with a recommendation. Only crossing overlaps are reported; exceptions above broader rules are not.
The rule stack view, with lines explained on hover.
Findings as CSV, and a branded PDF audit report.

Offline snapshots from FortiGate configuration files, FortiManager system backups (.dat) or a FortiManager export.
The read-only export script fmg-export.py, with --adom (ADOM names in the file name), token or password sign-in and --diagnose.
Uploads up to 200 MB (compressed exports up to 1 GB expanded).

Nested regions, regional IP pools, allocations and next-free-block suggestions.
Device health monitoring: down, congestion, interface errors, CPU and memory, with alerts by email, Microsoft Teams, Slack and webhook.

FireSight accounts, LDAP / Active Directory, OpenID Connect and SAML 2.0, with group-to-role mapping.
An append-only audit log with CSV export.

Per-firewall licensing with a signed license file, a 30-day evaluation for 10 firewalls, a 30-day grace period, system serial, activation requests and optional online renewal.

FortiManager workflow mode isn't supported.
FortiManager 7.4 backups can't be read; use the export script.
SAML encrypted assertions and signed authentication requests aren't supported.
Placement doesn't evaluate SD-WAN performance SLAs, ECMP load balancing or policy routes that match on ToS.
Other vendors are planned, not available.