Technical Tip: How to find unused (no hit count) policy in FortiManager via API

[ydong01]

Description	This article describes API query policy for IT audit.
Scope	FortiManager.
Solution	There is a requirement from IT audit department for find unused policy. It can use FortiGate API to find it, but if lot of FortiGate managed by FortiManager, use FortiManager API will be quick.  Hitcount information is not actively updated in FortiManager. It needs to be manually refreshed by GUI or API as described below to get the latest values ​​by associating the FortiGate via the API sent by FortiManager. Example: The FortiManager default policy view does not contain a hit count: After adding a hit count, the policy looks like this: Refresh hit count: Refresh option triggers a task： Task result: Use tools to find unused policies: Find unused policies: The above operations are manual and are not easy for plenty of FortiGate and ADOMs. The following are the API steps: Log in to FortiManager to get the session ID: Get ADOMs list: Get policy package name: Trigger hit count task:                                 Get unused policy ID:                                                 Logout FortiManager:                                               Troubleshooting: The below commands can be used on FortiManager CLI to debug the API Calls: diagnose debug service httpd 255 diagnose debug service main 255 For more details, visit https://fndn.fortinet.net/