MCP server for FortiAnalyzer JSON-RPC API. Query logs, alerts, incidents, FortiView analytics, and PCAPs from AI assistants.
概览
A Model Context Protocol (MCP) server for FortiAnalyzer JSON-RPC API. This server enables AI assistants like Claude to interact with FortiAnalyzer for log analysis, reporting, security monitoring, and SOC operations. : This is an independent open-source project and is not affiliated with, endorsed by, or supported by Fortinet, Inc. FortiAnalyzer is a trademark of Fortinet, Inc. This is an independent community project, not affiliated with or supported by Fortinet. Use at your own risk. Always validate changes in a non-production environment before applying to production systems.
README
以下为原文 README 节选，完整内容请查看原文。
FortiAnalyzer MCP Server
A Model Context Protocol (MCP) server for FortiAnalyzer JSON-RPC API. This server enables AI assistants like Claude to interact with FortiAnalyzer for log analysis, reporting, security monitoring, and SOC operations.
Note: This is an independent open-source project and is not affiliated with, endorsed by, or supported by Fortinet, Inc. FortiAnalyzer is a trademark of Fortinet, Inc.
Disclaimer: This is an independent community project, not affiliated with or supported by Fortinet. Use at your own risk. Always validate changes in a non-production environment before applying to production systems.
Overview
This MCP server provides a comprehensive interface to FortiAnalyzer’s capabilities, allowing AI assistants to:
- Query and analyze security logs (traffic, threat, event logs)
- Generate and download reports
- Monitor real-time analytics via FortiView
- Manage security alerts and incidents
- Perform IOC (Indicators of Compromise) analysis
- Manage devices and ADOMs
- Run higher-level SOC workflows via the skills layer (beta): incident correlation, triage, indicator/threat-intel enrichment, asset & identity lookups, risk scoring, and full incident investigation
- Optionally pseudonymize IOC/PII data before it reaches the model, reversibly (beta)
Features
| Category | Capabilities |
|---|---|
| Log Analysis | Query traffic, security, and event logs with filters; get log statistics |
| PCAP Downloads | Search IPS logs, download PCAP files by session ID or bulk download matching criteria |
| Reports | List layouts, run reports, monitor progress, download in PDF/HTML/CSV/XML |
| FortiView Analytics | Top sources, destinations, applications, threats, websites, cloud apps |
| Alerts & Events | Get alerts, acknowledge, add comments, view alert logs and statistics |
| Incident Management | Create, update, track incidents; get incident statistics |
| IOC Analysis | Run IOC rescans, check license status, view rescan history |
| Device Management | List/add/delete devices, manage device groups and VDOMs |
| System | System status, HA status, ADOM management, task monitoring |
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"fortianalyzer": {
"command": "/path/to/fortianalyzer-mcp/.venv/bin/fortianalyzer-mcp",
"env": {
"FORTIANALYZER_HOST": "your-faz-hostname",
"FORTIANALYZER_API_TOKEN": "your-api-token",
"FORTIANALYZER_VERIFY_SSL": "true",
"DEFAULT_ADOM": "root",
"LOG_LEVEL": "INFO"
}
}
}
}