Transport: stdio · JSON-RPC over /jsonrpc (the same dialect FortiManager speaks)
Requires: FORTIANALYZER_HOST, FORTIANALYZER_API_TOKEN (FortiAnalyzer 7.2.2+ for token auth)
Mode: read-only
The one rule that matters most here
"No logs matched" is NOT "this rule is unused."
This skill exists to answer "is this rule dead?" — and that question is dangerously
easy to answer wrongly. An empty result can mean:
nothing matched in the window you queried (retention is finite; history is not)
the device never forwarded logs to this analyzer at all
logging is disabled on the rule itself
Reporting any of those as "unused" would license someone to delete a live firewall
rule. So an empty result returns the explicit outcome no_logs_in_window, never
ok and never an error, with a message saying what it does and does not prove.
This is the same error class as spec 078's "no advisories ≠ not vulnerable" and
spec 079's "no probes found ≠ outage", and it gets the same treatment: a separate,
named outcome that cannot be silently collapsed.
Where this plane sits
Question
Plane
Skill
"Has anything actually matched this rule?"
analyzer
this skill
"What policy is intended?"
manager
fortimanager-ops
"What is the box running right now?"
device
fortigate-ops
The manager knows a rule exists. Only the analyzer knows whether anyone ever
matched it. A configured rule is not a used rule.