How mrpash89/rulescope-fortigate works
Rulescope is a read-only FortiGate security auditing and change-control tool for one firewall or a fleet. Its main workflow acquires configuration from a live REST API or backup, normalizes it into a snapshot, analyzes security and best-practice domains, then produces reports and remediation artifacts. Separate capabilities track snapshot changes, firmware advisories, imported usage data, and fleet status. The supplied excerpts show the snapshot model, several analysis/reporting responsibilities, and module references; some subsystem links are therefore documented at the README level rather than verified from implementation excerpts.
Main entry points: checks.py Audit orchestration · source.py Snapshot acquisition · fleet.py Fleet audit · diff.py Snapshot diff
Components 21
Acquisition
- REST API
rulescope/api.py - Snapshot acquisition
rulescope/source.py - Snapshot model
rulescope/model.py - Usage import
rulescope/usage.py
Audit analysis
- Audit orchestration
rulescope/checks.py - Finding catalog
rulescope/catalog.py - Object resolver
rulescope/resolve.py - Exposure analysis
rulescope/exposure.py - Hardening checks
rulescope/hardening.py - Practice baseline
rulescope/practices.py - Firmware advisories
rulescope/firmware.py
Change control
- Snapshot diff
rulescope/diff.py - Snapshot storage
rulescope/source.py
Reporting
- Report outputs
rulescope/report.py - HTML report
rulescope/htmlreport.py - Report styling
rulescope/ui.py
Fleet operations
- Fleet audit
rulescope/fleet.py - Change alerts
rulescope/notify.py
Other components
- Auditor
- FortiGate
- Config backup
Connections 28
- Auditor → Snapshot acquisition: requests audit
README.md - FortiGate → REST API: serves configuration
README.md - Config backup → Snapshot acquisition: provides config
README.md - Snapshot acquisition → REST API: fetches snapshot
README.md - Snapshot acquisition → Snapshot model: normalizes data
rulescope/source.py - Snapshot acquisition → Usage import: imports usage
README.md - Snapshot acquisition → Snapshot storage: saves snapshots
README.md - Auditor → Audit orchestration: runs audit
README.md - Audit orchestration → Snapshot model: analyzes snapshot
rulescope/checks.py - Audit orchestration → Finding catalog: creates findings
rulescope/checks.py - Audit orchestration → Object resolver: resolves objects
rulescope/checks.py - Audit orchestration → Exposure analysis: assesses exposure
rulescope/checks.py - Audit orchestration → Hardening checks: checks settings
rulescope/checks.py - Audit orchestration → Practice baseline: assesses practices
rulescope/checks.py - Auditor → Firmware advisories: requests advisories
README.md - Firmware advisories → FortiGate: checks version
README.md - Firmware advisories → Auditor: looks up CVEs
- Auditor → Snapshot diff: compares snapshots
README.md - Snapshot storage → Snapshot diff: supplies snapshots
README.md - Auditor → Fleet audit: audits fleet
README.md - Fleet audit → Snapshot storage: uses snapshots
rulescope/fleet.py - Fleet audit → Snapshot diff: tracks changes
rulescope/fleet.py - Fleet audit → Change alerts: sends alerts
rulescope/fleet.py - Audit orchestration → Report outputs: provides results
README.md - Snapshot diff → Report outputs: provides changes
README.md - Report outputs → HTML report: renders HTML
rulescope/report.py - HTML report → Report styling: uses styling
rulescope/htmlreport.py - Auditor → Report outputs: exports results
README.md