# mrpash89/rulescope-fortigate architecture

> Architecture diagram of the GitHub repository mrpash89/rulescope-fortigate, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mrpash89/rulescope-fortigate
- Repository: https://github.com/mrpash89/rulescope-fortigate

## Overview

Rulescope is a read-only FortiGate security auditing and change-control tool for one firewall or a fleet. Its main workflow acquires configuration from a live REST API or backup, normalizes it into a snapshot, analyzes security and best-practice domains, then produces reports and remediation artifacts. Separate capabilities track snapshot changes, firmware advisories, imported usage data, and fleet status. The supplied excerpts show the snapshot model, several analysis/reporting responsibilities, and module references; some subsystem links are therefore documented at the README level rather than verified from implementation excerpts.

Main entry points: [`rulescope/checks.py`](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/checks.py) (Audit orchestration), [`rulescope/source.py`](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/source.py) (Snapshot acquisition), [`rulescope/fleet.py`](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/fleet.py) (Fleet audit), [`rulescope/diff.py`](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/diff.py) (Snapshot diff)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_acquisition["Acquisition"]
  node_api["REST API<br/>[api.py]"]
  node_acquire["Snapshot acquisition<br/>[source.py]"]
  node_model["Snapshot model<br/>[model.py]"]
  node_usage["Usage import<br/>[usage.py]"]
end

subgraph group_analysis["Audit analysis"]
  node_checks["Audit orchestration<br/>[checks.py]"]
  node_catalog["Finding catalog<br/>[catalog.py]"]
  node_resolve["Object resolver<br/>[resolve.py]"]
  node_exposure["Exposure analysis<br/>[exposure.py]"]
  node_hardening["Hardening checks<br/>[hardening.py]"]
  node_practices["Practice baseline<br/>[practices.py]"]
  node_firmware["Firmware advisories<br/>[firmware.py]"]
end

subgraph group_change["Change control"]
  node_diff["Snapshot diff<br/>[diff.py]"]
  node_snapshot_store[("Snapshot storage<br/>[source.py]")]
end

subgraph group_outputs["Reporting"]
  node_report["Report outputs<br/>[report.py]"]
  node_html["HTML report<br/>[htmlreport.py]"]
  node_ui["Report styling<br/>[ui.py]"]
end

subgraph group_fleet["Fleet operations"]
  node_fleet_runner["Fleet audit<br/>[fleet.py]"]
  node_notifications["Change alerts<br/>[notify.py]"]
end

node_operator(("Auditor"))
node_firewall(("FortiGate"))
node_backup["Config backup"]

node_operator -->|"requests audit"| node_acquire
node_firewall -->|"serves configuration"| node_api
node_backup -->|"provides config"| node_acquire
node_acquire -->|"fetches snapshot"| node_api
node_acquire -->|"normalizes data"| node_model
node_acquire -->|"imports usage"| node_usage
node_acquire -->|"saves snapshots"| node_snapshot_store
node_operator -->|"runs audit"| node_checks
node_checks -->|"analyzes snapshot"| node_model
node_checks -->|"creates findings"| node_catalog
node_checks -->|"resolves objects"| node_resolve
node_checks -->|"assesses exposure"| node_exposure
node_checks -->|"checks settings"| node_hardening
node_checks -->|"assesses practices"| node_practices
node_operator -->|"requests advisories"| node_firmware
node_firmware -->|"checks version"| node_firewall
node_firmware -.->|"looks up CVEs"| node_operator
node_operator -->|"compares snapshots"| node_diff
node_snapshot_store -->|"supplies snapshots"| node_diff
node_operator -->|"audits fleet"| node_fleet_runner
node_fleet_runner -->|"uses snapshots"| node_snapshot_store
node_fleet_runner -->|"tracks changes"| node_diff
node_fleet_runner -->|"sends alerts"| node_notifications
node_checks -->|"provides results"| node_report
node_diff -->|"provides changes"| node_report
node_report -->|"renders HTML"| node_html
node_html -->|"uses styling"| node_ui
node_operator -->|"exports results"| node_report

click node_api "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/api.py"
click node_acquire "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/source.py"
click node_model "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/model.py"
click node_usage "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/usage.py"
click node_checks "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/checks.py"
click node_catalog "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/catalog.py"
click node_resolve "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/resolve.py"
click node_exposure "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/exposure.py"
click node_hardening "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/hardening.py"
click node_practices "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/practices.py"
click node_firmware "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/firmware.py"
click node_diff "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/diff.py"
click node_snapshot_store "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/source.py"
click node_fleet_runner "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/fleet.py"
click node_notifications "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/notify.py"
click node_report "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/report.py"
click node_html "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/htmlreport.py"
click node_ui "https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/ui.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_api,node_acquire,node_model,node_usage toneBlue
class node_checks,node_catalog,node_resolve,node_exposure,node_hardening,node_practices,node_firmware toneAmber
class node_diff,node_snapshot_store toneMint
class node_report,node_html,node_ui toneRose
class node_fleet_runner,node_notifications,node_operator,node_firewall,node_backup toneIndigo
```

## Components

### Acquisition

- [REST API](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/api.py): `rulescope/api.py`
- [Snapshot acquisition](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/source.py): `rulescope/source.py`
- [Snapshot model](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/model.py): `rulescope/model.py`
- [Usage import](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/usage.py): `rulescope/usage.py`

### Audit analysis

- [Audit orchestration](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/checks.py): `rulescope/checks.py`
- [Finding catalog](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/catalog.py): `rulescope/catalog.py`
- [Object resolver](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/resolve.py): `rulescope/resolve.py`
- [Exposure analysis](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/exposure.py): `rulescope/exposure.py`
- [Hardening checks](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/hardening.py): `rulescope/hardening.py`
- [Practice baseline](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/practices.py): `rulescope/practices.py`
- [Firmware advisories](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/firmware.py): `rulescope/firmware.py`

### Change control

- [Snapshot diff](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/diff.py): `rulescope/diff.py`
- [Snapshot storage](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/source.py): `rulescope/source.py`

### Reporting

- [Report outputs](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/report.py): `rulescope/report.py`
- [HTML report](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/htmlreport.py): `rulescope/htmlreport.py`
- [Report styling](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/ui.py): `rulescope/ui.py`

### Fleet operations

- [Fleet audit](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/fleet.py): `rulescope/fleet.py`
- [Change alerts](https://github.com/mrpash89/rulescope-fortigate/blob/main/rulescope/notify.py): `rulescope/notify.py`

### Other components

- **Auditor**
- **FortiGate**
- **Config backup**

## Connections

- Auditor → Snapshot acquisition: requests audit (evidence: `README.md`)
- FortiGate → REST API: serves configuration (evidence: `README.md`)
- Config backup → Snapshot acquisition: provides config (evidence: `README.md`)
- Snapshot acquisition → REST API: fetches snapshot (evidence: `README.md`)
- Snapshot acquisition → Snapshot model: normalizes data (evidence: `rulescope/source.py`)
- Snapshot acquisition → Usage import: imports usage (evidence: `README.md`)
- Snapshot acquisition → Snapshot storage: saves snapshots (evidence: `README.md`)
- Auditor → Audit orchestration: runs audit (evidence: `README.md`)
- Audit orchestration → Snapshot model: analyzes snapshot (evidence: `rulescope/checks.py`)
- Audit orchestration → Finding catalog: creates findings (evidence: `rulescope/checks.py`)
- Audit orchestration → Object resolver: resolves objects (evidence: `rulescope/checks.py`)
- Audit orchestration → Exposure analysis: assesses exposure (evidence: `rulescope/checks.py`)
- Audit orchestration → Hardening checks: checks settings (evidence: `rulescope/checks.py`)
- Audit orchestration → Practice baseline: assesses practices (evidence: `rulescope/checks.py`)
- Auditor → Firmware advisories: requests advisories (evidence: `README.md`)
- Firmware advisories → FortiGate: checks version (evidence: `README.md`)
- Firmware advisories → Auditor: looks up CVEs
- Auditor → Snapshot diff: compares snapshots (evidence: `README.md`)
- Snapshot storage → Snapshot diff: supplies snapshots (evidence: `README.md`)
- Auditor → Fleet audit: audits fleet (evidence: `README.md`)
- Fleet audit → Snapshot storage: uses snapshots (evidence: `rulescope/fleet.py`)
- Fleet audit → Snapshot diff: tracks changes (evidence: `rulescope/fleet.py`)
- Fleet audit → Change alerts: sends alerts (evidence: `rulescope/fleet.py`)
- Audit orchestration → Report outputs: provides results (evidence: `README.md`)
- Snapshot diff → Report outputs: provides changes (evidence: `README.md`)
- Report outputs → HTML report: renders HTML (evidence: `rulescope/report.py`)
- HTML report → Report styling: uses styling (evidence: `rulescope/htmlreport.py`)
- Auditor → Report outputs: exports results (evidence: `README.md`)