A FortiGate firewall analyzer that reads FortiOS directly.
SAMURAI is a self-hosted FortiGate firewall analyzer. It talks to the FortiOS REST API and pulls firewall policies, NAT (VIPs and IP pools), address and service objects, routes and VPN tunnels. Because it works from the configuration rather than the logs, you see the policy that’s actually loaded and every change to it, next to your Palo Alto and Cisco firewalls.
Updated June 2026
What it reads from FortiGate
Every policy, searchable
Filter FortiGate policies by interface or zone, address, service and action, across every FortiGate you’ve added.
NAT, VIPs and IP pools
Source and destination NAT, virtual IPs and IP pools, shown as the real addresses and ports they map to.
Objects expanded
Address and service groups are opened up at sync time, so a policy reads “tcp/443” instead of a group you have to click into.
Routes and VPN
The routing table, IPsec tunnels and SSL-VPN, next to the policies that govern that traffic.
Changes with a name attached
Each FortiOS configuration change is diffed and matched, by time window, to the admin who made it. You don’t need to keep logs around for that.
Beside everything else
FortiGate sits in the same dashboard as Palo Alto, Cisco FMC/FTD, your routers and switches, ACI, ISE and vCenter.
How it compares to FortiGate log analyzers
Tools sold as a “Fortinet firewall log analyzer” read FortiGate traffic and event logs. SAMURAI reads the FortiOS configuration instead: the policies, objects and routes, and every change made to them.
Data source
SAMURAI
FortiOS configuration, read over the REST API
FortiGate log analyzers
FortiGate traffic and event logs
Question it answers
SAMURAI
What’s the policy, and who changed it?
FortiGate log analyzers
What traffic was allowed or blocked?
Scope
SAMURAI
FortiGate plus Palo Alto, Cisco, routers, switches, ACI, ISE and vCenter
FortiGate log analyzers
Usually FortiGate logs only
Deployment
SAMURAI
One self-hosted Docker container, works air-gapped
FortiGate log analyzers
FortiAnalyzer appliance or a log pipeline
For traffic analytics on FortiGate, FortiAnalyzer or another log tool is the right choice. For policy visibility, resolved objects and change attribution across FortiGate and the rest of your network, use SAMURAI.
Frequently asked questions
How does SAMURAI connect to FortiGate?
Through the FortiOS REST API with an API token, or a username and password if you have to. Access is read-only: policies, NAT, address and service objects, routes and VPN configuration.
Does it resolve FortiGate address and service objects?
Yes. Objects and groups are expanded recursively when SAMURAI syncs, so a policy shows real addresses and services like “tcp/443” rather than object names.
Is this a Fortinet firewall log analyzer?
No. SAMURAI reads FortiOS configuration, not logs. For traffic analytics, use FortiAnalyzer or a log tool. SAMURAI covers the policy and its changes.
Can I see FortiGate alongside Palo Alto and Cisco?
Yes. FortiGate, Palo Alto and Cisco FMC/FTD policies share one search and one change timeline, next to the routers, switches and fabrics around them.
Can I try it on FortiGate for free?
Yes. The free test license comes with the Docker image, no email needed, so you can connect your own FortiGate before you talk to us.
What does deploying it take?
One container on a VM that can reach your FortiGate management interface. It’s usually serving data about five minutes later.