What problem does it solve?
Determining whether a firewall rule is genuinely unused is easy to get wrong: an empty log result can mean the device never forwarded logs, logging is disabled on the rule, or the query window was too short. This Skill queries FortiAnalyzer traffic logs within explicit, bounded time windows and returns a distinct no_logs_in_window outcome so silence is never misreported as proof a rule is dead.
Core Features & Use Cases
- Policy-filtered log queries: Search traffic logs by filter expression (e.g.
policyid=12) within a mandatory, echoed time window, with offset-based pagination via faz_fetch_more.
- Per-policy activity checks: Use
faz_policy_activity to learn whether anything matched a given policy in a window, with sessions_matched counts.
- Logging-device inventory: Run
faz_list_devices first to confirm the device owning the rule actually forwards logs to this analyzer before trusting any empty result.
- Use Case: Before decommissioning a firewall rule, confirm the device forwards logs, query a generous window for policy activity, and only treat the rule as a removal candidate after verifying log forwarding, retention coverage, and per-rule logging—then route the change through FortiManager with a ServiceNow CR.
Quick Start
Ask the agent to check whether any traffic has matched firewall policy 12 on FortiAnalyzer over the last 30 days.
