# keith0517/fortigate-utm-analyzer architecture

> Architecture diagram of the GitHub repository keith0517/fortigate-utm-analyzer, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/keith0517/fortigate-utm-analyzer
- Repository: https://github.com/keith0517/fortigate-utm-analyzer

## Overview

FortiGate UTM Security Analyzer is a single-file Python auditor: a user supplies a FortiGate full-configuration backup and receives severity-tagged security findings. The README documents broad audit coverage, including policy intelligence, unused objects, VIP exposure, DoS, SD-WAN, interface exposure, certificates, fabric integrations, and AI/LLM security. The repository has no separate implementation modules, so these capabilities are represented as responsibilities within utm.py. Internal dispatch and report-generation details are not established by the sampled excerpts.

Main entry points: [`utm.py`](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py) (Config parsing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflow["Audit workflow"]
  node_analyzer["Analyzer<br/>[utm.py]"]
  node_parser["Config parsing<br/>[utm.py]"]
  node_findings["Findings<br/>[utm.py]"]
end

subgraph group_security["Security audits"]
  node_policy["Policy intelligence<br/>[utm.py]"]
  node_unused["Unused objects<br/>[utm.py]"]
  node_cert["Certificate audit<br/>[utm.py]"]
end

subgraph group_network["Network and exposure"]
  node_antidos["Anti-DoS audit<br/>[utm.py]"]
  node_sdwan["SD-WAN audit<br/>[utm.py]"]
  node_interface["Interface exposure<br/>[utm.py]"]
  node_vip["VIP exposure<br/>[utm.py]"]
end

subgraph group_integrations["Integrations and profiles"]
  node_fabric["Fabric integration<br/>[utm.py]"]
  node_ai["AI/LLM security<br/>[utm.py]"]
  node_profiles["UTM profile checks<br/>[utm.py]"]
end

node_operator(("Operator"))
node_backup["Config backup"]

node_operator -->|"runs"| node_analyzer
node_backup -->|"supplies config"| node_analyzer
node_analyzer -->|"parses config"| node_parser
node_analyzer -->|"produces findings"| node_findings
node_parser -.->|"audits policies"| node_policy
node_parser -.->|"cross-references objects"| node_unused
node_parser -.->|"checks certificates"| node_cert
node_parser -.->|"audits DoS"| node_antidos
node_parser -.->|"audits SD-WAN"| node_sdwan
node_parser -.->|"scores exposure"| node_interface
node_parser -.->|"audits VIPs"| node_vip
node_parser -.->|"audits connectors"| node_fabric
node_parser -.->|"audits AI profiles"| node_ai
node_parser -.->|"checks profiles"| node_profiles
node_policy -.->|"reports issues"| node_findings
node_unused -.->|"reports orphans"| node_findings
node_cert -.->|"reports risks"| node_findings
node_antidos -.->|"reports risks"| node_findings
node_sdwan -.->|"reports gaps"| node_findings
node_interface -.->|"reports scores"| node_findings
node_vip -.->|"reports exposure"| node_findings
node_fabric -.->|"reports risks"| node_findings
node_ai -.->|"reports risks"| node_findings
node_profiles -.->|"reports weaknesses"| node_findings

click node_analyzer "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_parser "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_findings "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_policy "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_unused "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_cert "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_antidos "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_sdwan "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_interface "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_vip "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_fabric "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_ai "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"
click node_profiles "https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_analyzer,node_parser,node_findings toneBlue
class node_policy,node_unused,node_cert toneAmber
class node_antidos,node_sdwan,node_interface,node_vip toneMint
class node_fabric,node_ai,node_profiles toneRose
class node_operator,node_backup toneIndigo
```

## Components

### Audit workflow

- [Analyzer](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [Config parsing](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [Findings](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`

### Security audits

- [Policy intelligence](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [Unused objects](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [Certificate audit](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`

### Network and exposure

- [Anti-DoS audit](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [SD-WAN audit](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [Interface exposure](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [VIP exposure](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`

### Integrations and profiles

- [Fabric integration](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [AI/LLM security](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`
- [UTM profile checks](https://github.com/keith0517/fortigate-utm-analyzer/blob/main/utm.py): `utm.py`

### Other components

- **Operator**
- **Config backup**

## Connections

- Operator → Analyzer: runs (evidence: `README.md`)
- Config backup → Analyzer: supplies config (evidence: `README.md`)
- Analyzer → Config parsing: parses config (evidence: `README.md`)
- Analyzer → Findings: produces findings (evidence: `README.md`)
- Config parsing → Policy intelligence: audits policies (evidence: `utm.py`)
- Config parsing → Unused objects: cross-references objects (evidence: `utm.py`)
- Config parsing → Certificate audit: checks certificates (evidence: `utm.py`)
- Config parsing → Anti-DoS audit: audits DoS (evidence: `utm.py`)
- Config parsing → SD-WAN audit: audits SD-WAN (evidence: `utm.py`)
- Config parsing → Interface exposure: scores exposure (evidence: `utm.py`)
- Config parsing → VIP exposure: audits VIPs (evidence: `utm.py`)
- Config parsing → Fabric integration: audits connectors (evidence: `utm.py`)
- Config parsing → AI/LLM security: audits AI profiles (evidence: `utm.py`)
- Config parsing → UTM profile checks: checks profiles (evidence: `utm.py`)
- Policy intelligence → Findings: reports issues (evidence: `utm.py`)
- Unused objects → Findings: reports orphans (evidence: `utm.py`)
- Certificate audit → Findings: reports risks (evidence: `utm.py`)
- Anti-DoS audit → Findings: reports risks (evidence: `utm.py`)
- SD-WAN audit → Findings: reports gaps (evidence: `utm.py`)
- Interface exposure → Findings: reports scores (evidence: `utm.py`)
- VIP exposure → Findings: reports exposure (evidence: `utm.py`)
- Fabric integration → Findings: reports risks (evidence: `utm.py`)
- AI/LLM security → Findings: reports risks (evidence: `utm.py`)
- UTM profile checks → Findings: reports weaknesses (evidence: `utm.py`)