zabbix_export:
  version: '7.0'
  template_groups:
    - uuid: 36bff6c29af64692839d077febfc7079
      name: 'Templates/Network devices'
  templates:
    - uuid: e56c9577c225476eb6d8f1c2f5dc90a5
      template: 'FortiGate by HTTP'
      name: 'FortiGate by HTTP'
      description: |
        The template for monitoring FortiGate Next Generation Firewall by HTTP.
        
        1. On the FortiGate GUI, select System > Admin Profiles > Create New.
        2. Enter a profile name (ex. zabbix_ro) and enable all the Read permissions. Please note the profile name, it will be used a bit later.
        3. Go to System > Administrators > Create New > REST API Admin.
        4. Enter the API-user's name and select the profile name you created in step 2.
        5. The trusted host can be specified to ensure that only Zabbix server can reach the FortiGate.
        6. Click OK and an API token will be generated. Make a note of the API token as it's only shown once and cannot be retrieved.
        7. Put the API token into {$FGATE.API.TOKEN} macro.
        8. Set your FortiGate GUI IP/FQDN as {$FGATE.API.FQDN} macro value.
        9. If FortiGate GUI uses HTTPS, put "https" value into {$FGATE.SCHEME} macro and "443" into {$FGATE.API.PORT} macro.
        10. If FortiGate GUI port differs from the standard one, specify it in {$FGATE.API.PORT} macro.
        
        You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback.
        
        Generated by official Zabbix template tool "Templator"
      vendor:
        name: Zabbix
        version: 6.4-0
      groups:
        - name: 'Templates/Network devices'
      items:
        - uuid: e74af8e347814085a7d01142c9aae447
          name: 'FortiGate: API availability status'
          type: DEPENDENT
          key: fgate.api.status
          delay: '0'
          history: 7d
          trends: 90d
          description: 'Checking API availability by response.'
          valuemap:
            name: 'Service state'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.build
              error_handler: CUSTOM_VALUE
              error_handler_params: '0'
            - type: IN_RANGE
              parameters:
                - ''
                - '0'
              error_handler: CUSTOM_VALUE
              error_handler_params: '1'
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: health
            - tag: component
              value: network
          triggers:
            - uuid: 8b8c03f1497f4f18a417d103267d2947
              expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              name: 'FortiGate: Unexpected response from API'
              priority: AVERAGE
              description: 'Received an unexpected response from API. It may be unavailable.'
              dependencies:
                - name: 'FortiGate: Port {$FGATE.API.PORT} is unavailable'
                  expression: 'last(/FortiGate by HTTP/net.tcp.service["{$FGATE.SCHEME}","{$FGATE.API.FQDN}","{$FGATE.API.PORT}"])=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: 3a54a2ef2ad94f0d8df190356ca0ac9b
          name: 'FortiGate: Number of CPUs'
          type: DEPENDENT
          key: fgate.cpu.num
          delay: '0'
          history: 7d
          trends: 90d
          description: 'Number of processors according to the current license.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.vm.cpu_used
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.service.get_data
          tags:
            - tag: component
              value: cpu
        - uuid: 4c83427d66764255be934ea7e2c6084a
          name: 'FortiGate: CPU utilization'
          type: DEPENDENT
          key: fgate.cpu.util
          delay: '0'
          history: 7d
          value_type: FLOAT
          trends: 90d
          units: '%'
          description: 'CPU utilization, expressed in %.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.cpu
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: cpu
          triggers:
            - uuid: 4698d35fa5e242ef828ac4e3dba5bc09
              expression: 'min(/FortiGate by HTTP/fgate.cpu.util,5m)>{$CPU.UTIL.WARN}'
              name: 'FortiGate: CPU utilization is high'
              event_name: 'FortiGate: High CPU utilization (over {$CPU.UTIL.WARN}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: WARNING
              description: 'The CPU utilization is high.'
              dependencies:
                - name: 'FortiGate: CPU utilization is too high'
                  expression: 'min(/FortiGate by HTTP/fgate.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              tags:
                - tag: scope
                  value: performance
            - uuid: 170087cd8ebf4fc29093e5c1dbd86fea
              expression: 'min(/FortiGate by HTTP/fgate.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              name: 'FortiGate: CPU utilization is too high'
              event_name: 'FortiGate: High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: HIGH
              description: 'The CPU utilization is too high. The system might be slow to respond.'
              tags:
                - tag: scope
                  value: performance
        - uuid: c29e3336f92f448587e7492c55db8e7c
          name: 'FortiGate: Device firmware version'
          type: DEPENDENT
          key: fgate.device.firmware
          delay: '0'
          history: 7d
          value_type: CHAR
          trends: '0'
          description: 'Current version of the device firmware.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.results.current
            - type: JAVASCRIPT
              parameters:
                - |
                  var firmware = JSON.parse(value);
                  return firmware.name + ' ' + firmware.version + ' build' + String(firmware.build);
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.firmware.get_data
          tags:
            - tag: component
              value: system
        - uuid: 75084a08e92042e5869b57e34506849d
          name: 'FortiGate: Available firmware versions'
          type: DEPENDENT
          key: fgate.device.firmwares_avail
          delay: '0'
          history: 7d
          trends: 90d
          description: 'Number of available firmware versions to download.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.results.available.length()
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 12h
          master_item:
            key: fgate.firmware.get_data
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: da4a8352ffb94c15a62523a0b97460c4
              expression: '{$FIRMWARE.UPDATES.CONTROL}=1 and last(/FortiGate by HTTP/fgate.device.firmwares_avail)>0'
              name: 'FortiGate: New available firmware found'
              priority: INFO
              description: |
                New available firmware versions found to download.
                
                This trigger expression works as follows:
                1. It can be triggered if there are one or more available firmware versions.
                2. `{$FIRMWARE.UPDATES.CONTROL}=1` - a user can redefine context macro to value - 0. That marks this notification as not important. No new trigger will be fired if new firmware is found.
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: d42b5e392a6a468a84b009ff02f77b18
          name: 'FortiGate: Device model name'
          type: DEPENDENT
          key: fgate.device.model
          delay: '0'
          history: 7d
          value_type: CHAR
          trends: '0'
          description: 'The model name of the device.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.results
            - type: JAVASCRIPT
              parameters:
                - |
                  var info = JSON.parse(value);
                  return info.model_name + ' ' + info.model_number + ' (' + info.model + ')';
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: system
        - uuid: 80bafe55b05f416ebcdde86b58bda1f4
          name: 'FortiGate: Device serial number'
          type: DEPENDENT
          key: fgate.device.serialnumber
          delay: '0'
          history: 7d
          value_type: CHAR
          trends: '0'
          description: 'The device serial number.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.serial
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: 1426177b905e442fb2cdd963e8e8bba1
              expression: |
                last(/FortiGate by HTTP/fgate.device.serialnumber,#1)<>last(/FortiGate by HTTP/fgate.device.serialnumber,#2) and
                length(last(/FortiGate by HTTP/fgate.device.serialnumber))>0
              name: 'FortiGate: Device has been replaced'
              event_name: 'FortiGate: Device has been replaced (new serial number received)'
              priority: INFO
              description: 'Device serial number has changed. Acknowledge to close the problem manually.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: 07d3dd60460340929288fd21211aa2e0
          name: 'FortiGate: Current VDOM'
          type: DEPENDENT
          key: fgate.device.vdom
          delay: '0'
          history: 7d
          value_type: CHAR
          trends: '0'
          description: 'Name of the current Virtual Domain.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.vdom
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 12h
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: system
        - uuid: a6729f9b5da54e67951963a869fab31c
          name: 'FortiGate: Device firmware info item errors'
          type: DEPENDENT
          key: fgate.firmware.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of the device firmware info.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: CUSTOM_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.firmware.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: c4ab39fa9c104eaa8f9c5da529e416d8
              expression: 'length(last(/FortiGate by HTTP/fgate.firmware.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.firmware.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.firmware.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get firmware info'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: bc2ac899ea284703a6a8753ac5abc7c6
          name: 'FortiGate: Get firmware info'
          type: HTTP_AGENT
          key: fgate.firmware.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering device firmware info from FortiGate API.'
          preprocessing:
            - type: CHECK_NOT_SUPPORTED
              parameters:
                - '-1'
              error_handler: CUSTOM_VALUE
              error_handler_params: '{"error":"Not supported value received"}'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          url: '{$FGATE.SCHEME}://{$FGATE.API.FQDN}:{$FGATE.API.PORT}/api/v2/monitor/system/firmware'
          query_fields:
            - name: access_token
              value: '{$FGATE.API.TOKEN}'
          http_proxy: '{$FGATE.HTTP.PROXY}'
          tags:
            - tag: component
              value: raw
        - uuid: 3d93f75ee3084a5487814c2175028229
          name: 'FortiGate: Free disk space'
          type: DEPENDENT
          key: fgate.fs.free
          delay: '0'
          history: 7d
          trends: 90d
          units: B
          description: 'The free space of the current disk, in bytes.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.disk_free
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: storage
        - uuid: 3e595bf084f342ecaf94af97c2751c26
          name: 'FortiGate: Total disk space'
          type: DEPENDENT
          key: fgate.fs.total
          delay: '0'
          history: 7d
          trends: 90d
          units: B
          description: 'The total space of the current disk, in bytes.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.disk_total
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: storage
        - uuid: 6ddf5a6fc9cd4b7ca6522f8e86a7aac8
          name: 'FortiGate: Used disk space'
          type: DEPENDENT
          key: fgate.fs.used
          delay: '0'
          history: 7d
          trends: 90d
          units: B
          description: 'The used space of the current disk, in bytes.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.disk_used
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: storage
        - uuid: 847069b5ceaa417cbd84b1b0d5184771
          name: 'FortiGate: Disk utilization'
          type: DEPENDENT
          key: fgate.fs.util
          delay: '0'
          history: 7d
          value_type: FLOAT
          trends: 90d
          units: '%'
          description: 'Disk utilization, expressed in %.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.disk
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: storage
          triggers:
            - uuid: 649a5e3ba39e4e799835cdba8bba8d34
              expression: '(100-last(/FortiGate by HTTP/fgate.fs.util))<{$DISK.FREE.WARN}'
              name: 'FortiGate: Free disk space is low'
              event_name: 'FortiGate: Free disk space is less than {$DISK.FREE.WARN}%'
              priority: WARNING
              description: 'Left disk space is not enough.'
              dependencies:
                - name: 'FortiGate: Free disk space is too low'
                  expression: '(100-last(/FortiGate by HTTP/fgate.fs.util))<{$DISK.FREE.CRIT}'
              tags:
                - tag: scope
                  value: capacity
                - tag: scope
                  value: performance
            - uuid: 33c78beb669142baa66befba2456d810
              expression: '(100-last(/FortiGate by HTTP/fgate.fs.util))<{$DISK.FREE.CRIT}'
              name: 'FortiGate: Free disk space is too low'
              event_name: 'FortiGate: Free disk space is less than {$DISK.FREE.CRIT}%'
              priority: HIGH
              description: 'Left disk space is too low.'
              tags:
                - tag: scope
                  value: capacity
                - tag: scope
                  value: performance
        - uuid: 26441b122d1148b6ba1045fcdfd092ad
          name: 'FortiGate: Firewall data item errors'
          type: DEPENDENT
          key: fgate.fwp.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of firewall policies.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.fwp.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: a6f52f84c66c4d9b9831be03afc725b5
              expression: 'length(last(/FortiGate by HTTP/fgate.fwp.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.fwp.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.fwp.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get firewall policies data'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: a7f8a7da176040ab8a43618e14944e42
          name: 'FortiGate: Get firewall data'
          type: SCRIPT
          key: fgate.fwp.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          params: |
            var params = JSON.parse(value),
            	request = new HttpRequest(),
            	result = {"data": {}, "error": ""},
            	api_url = "",
            	policies = {},
            	error_msg = "";
            
            function getHttpData(url) {
            	response = request.get(url);
            	Zabbix.log(4, '[ FortiGate ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            	if (request.getStatus() !== 200) {
            		throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            	}
            
            	if (response !== null) {
            		try {
            			response = JSON.parse(response);
            		}
            		catch (error) {
            			throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            		}
            	}
            
            	if (typeof response !== 'object' || response === null) {
            		throw 'Cannot process response data: received data is not an object.';
            	}
            
            	if ((typeof response.status !== 'undefined' && response.status != 'success') || typeof response.results === 'undefined') {
            		var uri = '/' + response.path + '/' + response.name + ((typeof response.action !== 'undefined') ? '?action=' + response.action : "");
            		throw 'Failed to parse response received from ' + uri + '. Check debug log for more information.';
            	}
            
            	return response;
            };
            
            try {
            	['scheme', 'api.token', 'api.fqdn', 'api.port'].forEach(function (field) {
            		var macro = '{$FGATE.' + field.toUpperCase() + '}';
            		var key = field.split('.').pop();
            		if (params[key] === macro || params[key] === '') {
            			throw 'Please change ' + macro + ' macro to the proper value.';
            		}
            		if (typeof params[key] === 'undefined') {
            			throw 'Please set "' + key + '" script input parameter to ' + macro + ' macro value.';
            		}
            	});
            
            	if (typeof params.http_proxy !== 'undefined' && params.http_proxy !== '{' + '$FGATE.HTTP.PROXY}' && params.http_proxy !== '') {
            		request.setProxy(params.http_proxy);
            	}
            
            	api_url = params.scheme + '://' + params.fqdn + ':' + params.port;
            
            	var firewall_data = getHttpData(
            		api_url + '/api/v2/monitor/firewall/policy?access_token=' + encodeURIComponent(params.token)
            	);
            
            	var firewall_list = getHttpData(
            		api_url + '/api/v2/cmdb/firewall/policy?access_token=' + encodeURIComponent(params.token)
            	);
            
            	firewall_list.results.forEach(function (v) {
            		var item = {};
            		['q_origin_key', 'status', 'name', 'uuid', 'action', 'ip-version-type', 'label'].forEach(function (k) {
            			item[k] = v[k];
            		});
            		policies[v.policyid] = item;
            	});
            
            	result.data = firewall_data.results.map(function (v) {
            		if (typeof v.policyid !== 'undefined' && typeof policies[String(v.policyid)] !== 'undefined') {
            			Object.assign(v, policies[String(v.policyid)]);
            		}
            		return v;
            	}).filter(function (v) {
            		if (typeof v.name !== 'undefined') {
            			return v;
            		}
            	});
            } catch (error) {
            	error_msg = error.toString();
            	error_msg += error_msg.endsWith('.') ? '' : '.';
            	Zabbix.log(3, '[ FortiGate ] ERROR: ' + error_msg);
            };
            
            result.error = error_msg;
            
            return JSON.stringify(result);
          description: 'Item for gathering firewall policies info from FortiGate API.'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          parameters:
            - name: fqdn
              value: '{$FGATE.API.FQDN}'
            - name: http_proxy
              value: '{$FGATE.HTTP.PROXY}'
            - name: port
              value: '{$FGATE.API.PORT}'
            - name: scheme
              value: '{$FGATE.SCHEME}'
            - name: token
              value: '{$FGATE.API.TOKEN}'
          tags:
            - tag: component
              value: raw
        - uuid: 529076e8494e40f7b823f981e7159fd0
          name: 'FortiGate: Total memory'
          type: DEPENDENT
          key: fgate.memory.total
          delay: '0'
          history: 7d
          trends: 90d
          units: B
          description: 'Total memory, expressed in bytes.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.vm.mem_used
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          master_item:
            key: fgate.service.get_data
          tags:
            - tag: component
              value: memory
        - uuid: 51f4b31cc3d045a983843d9a8e534668
          name: 'FortiGate: Memory utilization'
          type: DEPENDENT
          key: fgate.memory.util
          delay: '0'
          history: 7d
          value_type: FLOAT
          trends: 90d
          units: '%'
          description: 'Memory utilization, expressed in %.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.mem
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: memory
          triggers:
            - uuid: 0f0b467715bb420a80cae7a7df50177d
              expression: 'min(/FortiGate by HTTP/fgate.memory.util,5m)>{$MEMORY.UTIL.WARN}'
              name: 'FortiGate: Memory utilization is high'
              event_name: 'FortiGate: High memory utilization (>{$MEMORY.UTIL.WARN}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: AVERAGE
              description: 'The system is running out of free memory.'
              dependencies:
                - name: 'FortiGate: Memory utilization is too high'
                  expression: 'min(/FortiGate by HTTP/fgate.memory.util,5m)>{$MEMORY.UTIL.CRIT}'
              tags:
                - tag: scope
                  value: capacity
                - tag: scope
                  value: performance
            - uuid: 4cd6cb4e21154f8489de2ba73f32e62d
              expression: 'min(/FortiGate by HTTP/fgate.memory.util,5m)>{$MEMORY.UTIL.CRIT}'
              name: 'FortiGate: Memory utilization is too high'
              event_name: 'FortiGate: High memory utilization (>{$MEMORY.UTIL.CRIT}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: HIGH
              description: 'Free memory size is too low.'
              tags:
                - tag: scope
                  value: capacity
                - tag: scope
                  value: performance
        - uuid: 562ec5b9dc7f49bb8ee404f05b1c54b7
          name: 'FortiGate: System name'
          type: DEPENDENT
          key: fgate.name
          delay: '0'
          history: 7d
          value_type: CHAR
          trends: '0'
          description: 'The system host name.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.results.hostname
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 12h
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: a522d2cdd55947fabf1c152f6f6dd374
              expression: 'last(/FortiGate by HTTP/fgate.name,#1)<>last(/FortiGate by HTTP/fgate.name,#2) and length(last(/FortiGate by HTTP/fgate.name))>0'
              name: 'FortiGate: System name has changed'
              event_name: 'FortiGate: System name has changed (new name: {ITEM.VALUE})'
              priority: INFO
              description: 'The name of the system has changed. Acknowledge to close the problem manually.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
                - tag: scope
                  value: security
        - uuid: c1dbb528c4324b6daa59c4393c3fd178
          name: 'FortiGate: Device interfaces item errors'
          type: DEPENDENT
          key: fgate.netif.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of network interfaces.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.netif.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: 20b8b33c1a36452ca280da95b8247409
              expression: 'length(last(/FortiGate by HTTP/fgate.netif.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.netif.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.netif.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get interfaces data'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: 3bf84b70672d4fbca282ce1bf970581d
          name: 'FortiGate: Get interfaces data'
          type: SCRIPT
          key: fgate.netif.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          params: |
            var params = JSON.parse(value),
            	request = new HttpRequest(),
            	result = {"data": {}, "error": ""},
            	api_url = "",
            	interfaces = {},
            	error_msg = "";
            
            function getHttpData(url) {
            	response = request.get(url);
            	Zabbix.log(4, '[ FortiGate ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            	if (request.getStatus() !== 200) {
            		throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            	}
            
            	if (response !== null) {
            		try {
            			response = JSON.parse(response);
            		}
            		catch (error) {
            			throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            		}
            	}
            
            	if (typeof response !== 'object' || response === null) {
            		throw 'Cannot process response data: received data is not an object.';
            	}
            
            	if ((typeof response.status !== 'undefined' && response.status != 'success') || typeof response.results === 'undefined') {
            		var uri = '/' + response.path + '/' + response.name + ((typeof response.action !== 'undefined') ? '?action=' + response.action : "");
            		throw 'Failed to parse response received from ' + uri + '. Check debug log for more information.';
            	}
            
            	return response;
            };
            
            try {
            	['scheme', 'api.token', 'api.fqdn', 'api.port'].forEach(function (field) {
            		var macro = '{$FGATE.' + field.toUpperCase() + '}';
            		var key = field.split('.').pop();
            		if (params[key] === macro || params[key] === '') {
            			throw 'Please change ' + macro + ' macro to the proper value.';
            		}
            		if (typeof params[key] === 'undefined') {
            			throw 'Please set "' + key + '" script input parameter to ' + macro + ' macro value.';
            		}
            	});
            
            	if (typeof params.http_proxy !== 'undefined' && params.http_proxy !== '{' + '$FGATE.HTTP.PROXY}' && params.http_proxy !== '') {
            		request.setProxy(params.http_proxy);
            	}
            
            	api_url = params.scheme + '://' + params.fqdn + ':' + params.port;
            
            	var netif_data = getHttpData(
            		api_url + '/api/v2/monitor/system/interface?access_token=' + encodeURIComponent(params.token)
            	);
            
            	var netif_list = getHttpData(
            		api_url + '/api/v2/cmdb/system/interface?access_token=' + encodeURIComponent(params.token)
            	);
            
            	result.data = netif_list.results.map(function (v) {
            		var item = {};
            		['q_origin_key', 'name', 'mode', 'type', 'description'].forEach(function (k) {
            			item[k] = v[k];
            		});
            		if (typeof item.q_origin_key !== 'undefined' && typeof netif_data.results[String(item.q_origin_key)] !== 'undefined') {
            			Object.assign(item, netif_data.results[String(item.q_origin_key)]);
            		}
            		if (typeof item.alias !== 'undefined') {
            			item.alias = item.alias.slice(1,-1);
            		}
            		else {
            			item.alias = '';
            		}
            		if (typeof item.link === 'undefined') {
            			item.link = false;
            		}
            		if (typeof item.id === 'undefined') {
            			item.id = item.q_origin_key;
            		}
            		return item;
            	});
            } catch (error) {
            	error_msg = error.toString();
            	error_msg += error_msg.endsWith('.') ? '' : '.';
            	Zabbix.log(3, '[ FortiGate ] ERROR: ' + error_msg);
            };
            
            result.error = error_msg;
            
            return JSON.stringify(result);
          description: 'Item for gathering network interfaces info from FortiGate API.'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          parameters:
            - name: fqdn
              value: '{$FGATE.API.FQDN}'
            - name: http_proxy
              value: '{$FGATE.HTTP.PROXY}'
            - name: port
              value: '{$FGATE.API.PORT}'
            - name: scheme
              value: '{$FGATE.SCHEME}'
            - name: token
              value: '{$FGATE.API.TOKEN}'
          tags:
            - tag: component
              value: raw
        - uuid: 1f612317d885472ea8b25ecb99a8debf
          name: 'FortiGate: Device resources item errors'
          type: DEPENDENT
          key: fgate.resources.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of the device resources.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.resources.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: e6ed25293ca64de1ae01e2ab6c92f5c7
              expression: 'length(last(/FortiGate by HTTP/fgate.resources.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.resources.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.resources.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get resources data'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: 06199d6a96f2414b976d357cd2c95cb6
          name: 'FortiGate: Get resources data'
          type: SCRIPT
          key: fgate.resources.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          params: |
            var params = JSON.parse(value),
            	request = new HttpRequest(),
            	result = {"data": {}, "error": ""},
            	api_url = "",
            	error_msg = "";
            
            function getHttpData(url) {
            	response = request.get(url);
            	Zabbix.log(4, '[ FortiGate ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            	if (request.getStatus() !== 200) {
            		throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            	}
            
            	if (response !== null) {
            		try {
            			response = JSON.parse(response);
            		}
            		catch (error) {
            			throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            		}
            	}
            
            	if (typeof response !== 'object' || response === null) {
            		throw 'Cannot process response data: received data is not an object.';
            	}
            
            	if ((typeof response.status !== 'undefined' && response.status != 'success') || typeof response.results === 'undefined') {
            		var uri = '/' + response.path + '/' + response.name + ((typeof response.action !== 'undefined') ? '?action=' + response.action : "");
            		throw 'Failed to parse response received from ' + uri + '. Check debug log for more information.';
            	}
            
            	return response;
            };
            
            try {
            	['scheme', 'api.token', 'api.fqdn', 'api.port'].forEach(function (field) {
            		var macro = '{$FGATE.' + field.toUpperCase() + '}';
            		var key = field.split('.').pop();
            		if (params[key] === macro || params[key] === '') {
            			throw 'Please change ' + macro + ' macro to the proper value.';
            		}
            		if (typeof params[key] === 'undefined') {
            			throw 'Please set "' + key + '" script input parameter to ' + macro + ' macro value.';
            		}
            	});
            
            	if (typeof params.http_proxy !== 'undefined' && params.http_proxy !== '{' + '$FGATE.HTTP.PROXY}' && params.http_proxy !== '') {
            		request.setProxy(params.http_proxy);
            	}
            
            	api_url = params.scheme + '://' + params.fqdn + ':' + params.port;
            
            	var resource_list = getHttpData(
            		api_url + '/api/v2/monitor/system/resource/usage?access_token=' + encodeURIComponent(params.token) + '&interval=1-min'
            	);
            
            	var disk_info = getHttpData(
            		api_url + '/api/v2/monitor/log/current-disk-usage?access_token=' + encodeURIComponent(params.token)
            	);
            
            	if (typeof resource_list.results !== 'undefined' && typeof resource_list.results === 'object') {
            		Object.keys(resource_list.results).forEach(function (key) {
            			var resource = resource_list.results[key];
            			if (resource.length > 0) {
            				result.data[key] = resource[0].current;
            			}
            		});
            	}
            	else {
            		throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            	}
            
            	Object.keys(disk_info.results).forEach(function (key) {
            		result.data['disk_' + key.split('_')[0]] = disk_info.results[key];
            	});
            } catch (error) {
            	error_msg = error.toString();
            	error_msg += error_msg.endsWith('.') ? '' : '.';
            	Zabbix.log(3, '[ FortiGate ] ERROR: ' + error_msg);
            };
            
            result.error = error_msg;
            
            return JSON.stringify(result);
          description: 'Item for gathering device resource data from FortiGate API.'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          parameters:
            - name: fqdn
              value: '{$FGATE.API.FQDN}'
            - name: http_proxy
              value: '{$FGATE.HTTP.PROXY}'
            - name: port
              value: '{$FGATE.API.PORT}'
            - name: scheme
              value: '{$FGATE.SCHEME}'
            - name: token
              value: '{$FGATE.API.TOKEN}'
          tags:
            - tag: component
              value: raw
        - uuid: 1f2885ffb1524d909292aa9e5d1d8c89
          name: 'FortiGate: Get SD-WAN item errors'
          type: DEPENDENT
          key: fgate.sdwan.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of SD-WAN.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.sdwan.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: b2ec3a4cf468449388a33f76688dc259
              expression: 'length(last(/FortiGate by HTTP/fgate.sdwan.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.sdwan.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.sdwan.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get SD-WAN data'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: 01814568a3bc4774a37957ff3d8c5e09
          name: 'FortiGate: Get SD-WAN data'
          type: SCRIPT
          key: fgate.sdwan.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          params: |
            var params = JSON.parse(value),
            	request = new HttpRequest(),
            	result = {"data": {}, "error": ""},
            	api_url = "",
            	health_members = [],
            	health_checks = [],
            	members = {},
            	error_msg = "";
            
            function getHttpData(url) {
            	response = request.get(url);
            	Zabbix.log(4, '[ FortiGate ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            	if (request.getStatus() !== 200) {
            		throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            	}
            
            	if (response !== null) {
            		try {
            			response = JSON.parse(response);
            		}
            		catch (error) {
            			throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            		}
            	}
            
            	if (typeof response !== 'object' || response === null) {
            		throw 'Cannot process response data: received data is not an object.';
            	}
            
            	if ((typeof response.status !== 'undefined' && response.status != 'success') || typeof response.results === 'undefined') {
            		var uri = '/' + response.path + '/' + response.name + ((typeof response.action !== 'undefined') ? '?action=' + response.action : "");
            		throw 'Failed to parse response received from ' + uri + '. Check debug log for more information.';
            	}
            
            	return response;
            };
            
            try {
            	['scheme', 'api.token', 'api.fqdn', 'api.port'].forEach(function (field) {
            		var macro = '{$FGATE.' + field.toUpperCase() + '}';
            		var key = field.split('.').pop();
            		if (params[key] === macro || params[key] === '') {
            			throw 'Please change ' + macro + ' macro to the proper value.';
            		}
            		if (typeof params[key] === 'undefined') {
            			throw 'Please set "' + key + '" script input parameter to ' + macro + ' macro value.';
            		}
            	});
            
            	if (typeof params.http_proxy !== 'undefined' && params.http_proxy !== '{' + '$FGATE.HTTP.PROXY}' && params.http_proxy !== '') {
            		request.setProxy(params.http_proxy);
            	}
            
            	api_url = params.scheme + '://' + params.fqdn + ':' + params.port;
            
            	var sdwan_member_data = getHttpData(
            		api_url + '/api/v2/monitor/virtual-wan/members?access_token=' + encodeURIComponent(params.token)
            	);
            
            	var sdwan_health_data = getHttpData(
            		api_url + '/api/v2/monitor/virtual-wan/health-check?access_token=' + encodeURIComponent(params.token)
            	);
            
            	var sdwan_list = getHttpData(
            		api_url + '/api/v2/cmdb/system/sdwan?access_token=' + encodeURIComponent(params.token)
            	);
            
            	sdwan_list.results['health-check'].forEach(function (item) {
            		health_checks[item.q_origin_key] = item.members.length;
            		item.members.forEach(function (m) {
            			health_members.push({
            				'member_id': m.q_origin_key,
            				'health_id': item.q_origin_key,
            				'health_name': item.name,
            			});
            		});
            	});
            
            	sdwan_list.results.members.forEach(function (item) {
            		members[item.q_origin_key] = item;
            	});
            
            	result.data = {
            		'member_lld': sdwan_list.results.members.filter(function (v) {
            			if (v.interface.length > 0) {
            				return v;
            			}
            		}).map(function (v) {
            			if (typeof v.interface !== 'undefined' && typeof sdwan_member_data.results[v.interface] !== 'undefined') {
            				Object.assign(v, sdwan_member_data.results[v.interface]);
            			}
            			return v;
            		}),
            		'health_lld': health_members.map(function (m) {
            			var item = {};
            			if (typeof members[String(m.member_id)] !== 'undefined') {
            				['interface', 'status'].forEach(function (k) {
            					item[k] = members[String(m.member_id)][k];
            				});
            				Object.assign(item, m);
            			};
            			return item;
            		}).filter(function (v) {
            			if (v.interface.length > 0) {
            				return v;
            			}
            		}),
            		'health_data': sdwan_list.results['health-check'].filter(function (v) {
            			if (typeof health_checks[String(v.q_origin_key)] !== 'undefined' && health_checks[String(v.q_origin_key)] > 0) {
            				return v;
            			}
            		}).map(function (v) {
            			delete v.members;
            			if (typeof v.name !== 'undefined' && typeof sdwan_health_data.results[v.name] !== 'undefined') {
            				Object.assign(v, sdwan_health_data.results[v.name]);
            			}
            			return v;
            		})
            	}
            } catch (error) {
            	error_msg = error.toString();
            	error_msg += error_msg.endsWith('.') ? '' : '.';
            	Zabbix.log(3, '[ FortiGate ] ERROR: ' + error_msg);
            };
            
            result.error = error_msg;
            
            return JSON.stringify(result);
          description: 'Item for gathering SD-WAN information from FortiGate API.'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          parameters:
            - name: fqdn
              value: '{$FGATE.API.FQDN}'
            - name: http_proxy
              value: '{$FGATE.HTTP.PROXY}'
            - name: port
              value: '{$FGATE.API.PORT}'
            - name: scheme
              value: '{$FGATE.SCHEME}'
            - name: token
              value: '{$FGATE.API.TOKEN}'
          tags:
            - tag: component
              value: raw
        - uuid: 547c3bfa4a2d4b8e8ebfad01b200c4fd
          name: 'FortiGate: Service licenses item errors'
          type: DEPENDENT
          key: fgate.service.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of the service licenses data.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: DISCARD_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.service.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: eeb819b2813f488ea3792a029f25a08d
              expression: 'length(last(/FortiGate by HTTP/fgate.service.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.service.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.service.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get service licenses'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: 90a78cff28d54a1b9b955e9dc94d48c7
          name: 'FortiGate: Get service licenses'
          type: SCRIPT
          key: fgate.service.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          params: |
            var params = JSON.parse(value),
            	request = new HttpRequest(),
            	result = {"data": {}, "lld": [], "error": ""},
            	api_url = "",
            	error_msg = "";
            
            function getHttpData(url) {
            	response = request.get(url);
            	Zabbix.log(4, '[ FortiGate ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            	if (request.getStatus() !== 200) {
            		throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            	}
            
            	if (response !== null) {
            		try {
            			response = JSON.parse(response);
            		}
            		catch (error) {
            			throw 'Failed to parse response received from FortiGate API. Check debug log for more information.';
            		}
            	}
            
            	if (typeof response !== 'object' || response === null) {
            		throw 'Cannot process response data: received data is not an object.';
            	}
            
            	if ((typeof response.status !== 'undefined' && response.status != 'success') || typeof response.results === 'undefined') {
            		var uri = '/' + response.path + '/' + response.name + ((typeof response.action !== 'undefined') ? '?action=' + response.action : "");
            		throw 'Failed to parse response received from ' + uri + '. Check debug log for more information.';
            	}
            
            	return response;
            };
            
            function capitalize(word, idx) {
            	return upAcronymCase(word.charAt(idx).toUpperCase() + word.slice(idx+1));
            }
            
            function upAcronymCase(word) {
            	if (word.length < 4) {
            		return word.toUpperCase()
            	}
            	return word;
            }
            
            function prepareServiceName(key) {
            	var result = [];
            	key.split('_').forEach(function (w) {
            		var forti_idx = w.indexOf('forti');
            		w = upAcronymCase(w);
            		if (forti_idx !== -1)
            			w = 'Forti' + capitalize(w, forti_idx + 5);
            		else
            			w = capitalize(w, 0)
            		result.push(w);
            	});
            
            	return result.join(' ');
            };
            
            try {
            	['scheme', 'api.token', 'api.fqdn', 'api.port'].forEach(function (field) {
            		var macro = '{$FGATE.' + field.toUpperCase() + '}';
            		var key = field.split('.').pop();
            		if (params[key] === macro || params[key] === '') {
            			throw 'Please change ' + macro + ' macro to the proper value.';
            		}
            		if (typeof params[key] === 'undefined') {
            			throw 'Please set "' + key + '" script input parameter to ' + macro + ' macro value.';
            		}
            	});
            
            	api_url = params.scheme + '://' + params.fqdn + ':' + params.port;
            
            	if (typeof params.http_proxy !== 'undefined' && params.http_proxy !== '{' + '$FGATE.HTTP.PROXY}' && params.http_proxy !== '') {
            		request.setProxy(params.http_proxy);
            	}
            
            	var licence_list = getHttpData(
            		api_url + '/api/v2/monitor/license/status?access_token=' + encodeURIComponent(params.token)
            	);
            
            	result.data = licence_list.results;
            	Object.keys(licence_list.results).forEach(function (key) {
            		var resource = licence_list.results[key];
            		if (typeof resource.status !== 'undefined' && typeof resource.type !== 'undefined') {
            			result.lld.push({
            				"key": key,
            				"name": prepareServiceName(key),
            				"status": resource.status,
            				"type": resource.type,
            			});
            		}
            	});
            } catch (error) {
            	error_msg = error.toString();
            	error_msg += error_msg.endsWith('.') ? '' : '.';
            	Zabbix.log(3, '[ FortiGate ] ERROR: ' + error_msg);
            };
            
            result.error = error_msg;
            
            return JSON.stringify(result);
          description: 'Item for gathering information about service licenses from FortiGate API.'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          parameters:
            - name: fqdn
              value: '{$FGATE.API.FQDN}'
            - name: http_proxy
              value: '{$FGATE.HTTP.PROXY}'
            - name: port
              value: '{$FGATE.API.PORT}'
            - name: scheme
              value: '{$FGATE.SCHEME}'
            - name: token
              value: '{$FGATE.API.TOKEN}'
          tags:
            - tag: component
              value: raw
        - uuid: 8d8d4e7073db4ad497f4ca8dfffa043c
          name: 'FortiGate: Device system info item errors'
          type: DEPENDENT
          key: fgate.system.data_errors
          delay: '0'
          history: 7d
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering errors of the device system info.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.error
              error_handler: CUSTOM_VALUE
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: error
          triggers:
            - uuid: 3d1dbc0964db401fa9c10c1b126349e4
              expression: 'length(last(/FortiGate by HTTP/fgate.system.data_errors))>0 and length(last(/FortiGate by HTTP/fgate.system.data_errors,#1:now-1m))>0 and nodata(/FortiGate by HTTP/fgate.system.data_errors,2m)=0'
              name: 'FortiGate: There are errors in the ''Get system info'' metric'
              priority: WARNING
              dependencies:
                - name: 'FortiGate: Unexpected response from API'
                  expression: 'last(/FortiGate by HTTP/fgate.api.status)=0'
              tags:
                - tag: scope
                  value: availability
        - uuid: a6b831300e7048fbad4502973d0318e7
          name: 'FortiGate: Get system info'
          type: HTTP_AGENT
          key: fgate.system.get_data
          history: '0'
          value_type: TEXT
          trends: '0'
          description: 'Item for gathering device system info from FortiGate API.'
          preprocessing:
            - type: CHECK_NOT_SUPPORTED
              parameters:
                - '-1'
              error_handler: CUSTOM_VALUE
              error_handler_params: '{"error":"Not supported value received"}'
          timeout: '{$FGATE.DATA.TIMEOUT}'
          url: '{$FGATE.SCHEME}://{$FGATE.API.FQDN}:{$FGATE.API.PORT}/api/v2/monitor/web-ui/state'
          query_fields:
            - name: access_token
              value: '{$FGATE.API.TOKEN}'
          http_proxy: '{$FGATE.HTTP.PROXY}'
          tags:
            - tag: component
              value: raw
        - uuid: 924a859579bd41a9b26dc83f92100577
          name: 'FortiGate: System uptime'
          type: DEPENDENT
          key: fgate.uptime
          delay: '0'
          history: 7d
          trends: 90d
          units: uptime
          description: 'The system uptime is calculated on the basis of boot time.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.results.utc_last_reboot
            - type: JAVASCRIPT
              parameters:
                - 'return (Math.floor(Date.now()/1000)-Math.floor(Number(value)/1000));'
          master_item:
            key: fgate.system.get_data
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: 183385fa495442bcbd3eb28636ca5bb9
              expression: 'last(/FortiGate by HTTP/fgate.uptime)<10m'
              name: 'FortiGate: Device has been restarted'
              event_name: 'FortiGate: {HOST.NAME} has been restarted (uptime < 10m)'
              priority: INFO
              description: 'Uptime is less than 10 minutes.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: 27d30f93ff7c49d89537c43bad5f9453
          name: 'FortiGate: Check port availability'
          type: SIMPLE
          key: 'net.tcp.service["{$FGATE.SCHEME}","{$FGATE.API.FQDN}","{$FGATE.API.PORT}"]'
          history: 7d
          trends: 90d
          valuemap:
            name: 'Service state'
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 10m
          tags:
            - tag: component
              value: health
            - tag: component
              value: network
          triggers:
            - uuid: 26abf8698af247d09c325ab1cb3e9903
              expression: 'last(/FortiGate by HTTP/net.tcp.service["{$FGATE.SCHEME}","{$FGATE.API.FQDN}","{$FGATE.API.PORT}"])=0'
              name: 'FortiGate: Port {$FGATE.API.PORT} is unavailable'
              priority: AVERAGE
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: availability
      discovery_rules:
        - uuid: 13ff598606764abbaec4d0b9f6cbbf33
          name: 'Firewall policies discovery'
          type: DEPENDENT
          key: fgate.fwp.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#FWACTION}'
                value: '{$FWP.FWACTION.MATCHES}'
                formulaid: A
              - macro: '{#FWACTION}'
                value: '{$FWP.FWACTION.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#FWNAME}'
                value: '{$FWP.FWNAME.MATCHES}'
                formulaid: C
              - macro: '{#FWNAME}'
                value: '{$FWP.FWNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#FWTYPE}'
                value: '{$FWP.FWTYPE.MATCHES}'
                formulaid: E
              - macro: '{#FWTYPE}'
                value: '{$FWP.FWTYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
          lifetime: 30d
          enabled_lifetime_type: DISABLE_NEVER
          description: 'Discovery for FortiGate firewall policies.'
          item_prototypes:
            - uuid: 19b27ab621a1417f86ddbd52d93f6c55
              name: 'FW Policy [{#FWNAME}]: Action'
              type: DEPENDENT
              key: 'fgate.fwp.action[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The firewall policy action (accept / deny / ipsec).'
              valuemap:
                name: 'Firewall policy action'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.action
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'accept',
                      	'deny',
                      	'ipsec'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 10;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 12h
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 61bf8afdf8f04c9197077978706b1adc
              name: 'FW Policy [{#FWNAME}]: Total bytes processed'
              type: DEPENDENT
              key: 'fgate.fwp.bytes[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: B
              description: 'Number of bytes processed by both the software and hardware (ASIC) firewall.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.bytes
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: ee45ca237e074dd0a599ae1b29896329
              name: 'FW Policy [{#FWNAME}]: Get data'
              type: DEPENDENT
              key: 'fgate.fwp.get_data[{#FWUUID}]'
              delay: '0'
              history: '0'
              value_type: TEXT
              trends: '0'
              description: 'Item for gathering data for the {#FWNAME} firewall policy.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.data[?(@.uuid == "{#FWUUID}")].first()'
                  error_handler: DISCARD_VALUE
              master_item:
                key: fgate.fwp.get_data
              tags:
                - tag: component
                  value: raw
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: cae79524205c491990b967035ca4e753
              name: 'FW Policy [{#FWNAME}]: Hits into the policy'
              type: DEPENDENT
              key: 'fgate.fwp.hits[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Number of packets hit into the firewall policy per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.hit_count
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 333596806faf457b9dfcb90a8c11bd25
              name: 'FW Policy [{#FWNAME}]: Hardware processed bytes'
              type: DEPENDENT
              key: 'fgate.fwp.hw_bytes[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: B
              description: 'Number of bytes processed only by the hardware (ASIC) firewall.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.asic_bytes
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 5b5c10ff4c8a4e47a550d1c0563e78e1
              name: 'FW Policy [{#FWNAME}]: Last using time'
              type: DEPENDENT
              key: 'fgate.fwp.last_used[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: unixtime
              description: 'The time at which the firewall policy was used the last time.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.last_used
                  error_handler: DISCARD_VALUE
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 1255b5df630b4af782cd00d59cb49fe0
              name: 'FW Policy [{#FWNAME}]: Active sessions'
              type: DEPENDENT
              key: 'fgate.fwp.sessions[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Number of active sessions covered by this rule.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.active_sessions
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 3cedbb09e06547e682843679811a6a40
              name: 'FW Policy [{#FWNAME}]: Status'
              type: DEPENDENT
              key: 'fgate.fwp.status[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The firewall policy status.'
              valuemap:
                name: 'Firewall policy status'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.status
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'enable',
                      	'disable'
                      ].indexOf(value);
                      return idx !== -1 ? idx : value;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
            - uuid: 838a630bc233403f9be41dd079a52b67
              name: 'FW Policy [{#FWNAME}]: Software processed bytes'
              type: DEPENDENT
              key: 'fgate.fwp.sw_bytes[{#FWUUID}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: B
              description: 'Number of bytes processed only by the software firewall.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.software_bytes
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.fwp.get_data[{#FWUUID}]'
              tags:
                - tag: component
                  value: firewall
                - tag: policy
                  value: '{#FWNAME}'
          graph_prototypes:
            - uuid: 1bbf600910de437dbc88f9340ebd7afd
              name: 'FW Policy [{#FWNAME}]: Active sessions'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.fwp.sessions[{#FWUUID}]'
            - uuid: 28abccb8b1c94ca787e38a773c0e282c
              name: 'FW Policy [{#FWNAME}]: Hits into the policy'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.fwp.hits[{#FWUUID}]'
            - uuid: b449d42f646b4318a862fa786387d783
              name: 'FW Policy [{#FWNAME}]: Policy processing'
              graph_items:
                - drawtype: GRADIENT_LINE
                  color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.fwp.sw_bytes[{#FWUUID}]'
                - sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: F63100
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.fwp.hw_bytes[{#FWUUID}]'
                - sortorder: '2'
                  drawtype: BOLD_LINE
                  color: 00611C
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.fwp.bytes[{#FWUUID}]'
          master_item:
            key: fgate.fwp.get_data
          lld_macro_paths:
            - lld_macro: '{#FWACTION}'
              path: $.action
            - lld_macro: '{#FWINDEX}'
              path: $.policyid
            - lld_macro: '{#FWLABEL}'
              path: $.label
            - lld_macro: '{#FWNAME}'
              path: $.name
            - lld_macro: '{#FWTYPE}'
              path: '$["ip-version-type"]'
            - lld_macro: '{#FWUUID}'
              path: $.uuid
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: b5d0c50d4ff8400a93618df5d2185ff7
          name: 'Network interfaces discovery'
          type: DEPENDENT
          key: fgate.netif.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.MATCHES}'
                formulaid: A
              - macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.MATCHES}'
                formulaid: C
              - macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.MATCHES}'
                formulaid: E
              - macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
              - macro: '{#IFSTATUS}'
                value: '{$NET.IF.IFSTATUS.MATCHES}'
                formulaid: G
              - macro: '{#IFSTATUS}'
                value: '{$NET.IF.IFSTATUS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: H
              - macro: '{#IFTYPE}'
                value: '{$NET.IF.IFTYPE.MATCHES}'
                formulaid: I
              - macro: '{#IFTYPE}'
                value: '{$NET.IF.IFTYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: J
          lifetime: 30d
          enabled_lifetime_type: DISABLE_NEVER
          description: 'Discovery for FortiGate network interfaces.'
          item_prototypes:
            - uuid: afb2dec9321a4eb1821b366c5219ce60
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Get data'
              type: DEPENDENT
              key: 'fgate.netif.get_data[{#IFKEY}]'
              delay: '0'
              history: '0'
              value_type: TEXT
              trends: '0'
              description: 'Item for gathering data for the {#IFKEY} interface.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.data[?(@.id == "{#IFKEY}")].first()'
                  error_handler: DISCARD_VALUE
              master_item:
                key: fgate.netif.get_data
              tags:
                - tag: component
                  value: raw
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: 76c143854ca8400ea0af95debdc8f8d9
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Bits received'
              type: DEPENDENT
              key: 'fgate.netif.in[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: bps
              description: 'The total number of octets received on the interface per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.rx_bytes
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                - type: MULTIPLIER
                  parameters:
                    - '8'
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: ef7ce50437034277bcc33af137d87e1b
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Inbound packets with errors'
              type: DEPENDENT
              key: 'fgate.netif.in_errors[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The total number of errors received.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.rx_errors
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
              trigger_prototypes:
                - uuid: 9ef845b9e393423f96403ea4c195859e
                  expression: 'min(/FortiGate by HTTP/fgate.netif.in_errors[{#IFKEY}],5m)>{$NET.IF.ERRORS.WARN:"{#IFKEY}"} or min(/FortiGate by HTTP/fgate.netif.in_errors[{#IFKEY}],5m)>{$NET.IF.ERRORS.WARN:"{#IFKEY}"}'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'max(/FortiGate by HTTP/fgate.netif.in_errors[{#IFKEY}],5m)<{$NET.IF.ERRORS.WARN:"{#IFKEY}"}*0.8 and max(/FortiGate by HTTP/fgate.netif.in_errors[{#IFKEY}],5m)<{$NET.IF.ERRORS.WARN:"{#IFKEY}"}*0.8'
                  name: 'Interface [{#IFNAME}({#IFALIAS})]: High error rate'
                  event_name: 'Interface [{#IFNAME}({#IFALIAS})]: High error rate (>{$NET.IF.ERRORS.WARN:"{#IFKEY}"} for 5m)'
                  opdata: 'errors in: {ITEM.LASTVALUE1}, errors out: {ITEM.LASTVALUE2}'
                  priority: WARNING
                  description: 'It recovers when it is below 80% of the `{$NET.IF.ERRORS.WARN:"{#IFKEY}"}` threshold.'
                  manual_close: 'YES'
                  dependencies:
                    - name: 'Interface [{#IFNAME}({#IFALIAS})]: Link down'
                      expression: '{$NET.IF.CONTROL:"{#IFNAME}"}=1 and last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])=1 and (last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#1)<>last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#2))'
                      recovery_expression: 'last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])<>1 or {$NET.IF.CONTROL:"{#IFNAME}"}=0'
                  tags:
                    - tag: scope
                      value: availability
                    - tag: scope
                      value: performance
            - uuid: 75bd8c58c1f94a2aaaca0afdc8ebc1eb
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Inbound packets'
              type: DEPENDENT
              key: 'fgate.netif.in_packets[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The total number of packets received on the interface per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.rx_packets
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: 479786a0a0414a609ce7fffbc51519ec
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Bits sent'
              type: DEPENDENT
              key: 'fgate.netif.out[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: bps
              description: 'The total number of octets transmitted out of the interface.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.tx_bytes
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                - type: MULTIPLIER
                  parameters:
                    - '8'
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: bfab84d969614ef0945ca9ff54d8ea27
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Outbound packets with errors'
              type: DEPENDENT
              key: 'fgate.netif.out_errors[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The total number of errors transmitted.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.tx_errors
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: 8520c14ac47246c896d068f5be80f4b0
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Outbound packets'
              type: DEPENDENT
              key: 'fgate.netif.out_packets[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'The total number of packets transmitted out of the interface per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.tx_packets
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: 0912c8f0928242df905c43d2320d0004
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Speed'
              type: DEPENDENT
              key: 'fgate.netif.speed[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: bps
              description: 'Speed of the interface.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.speed
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: MULTIPLIER
                  parameters:
                    - '1000000'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
            - uuid: e0dbfeb62ad14260a299263be8db631c
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Link status'
              type: DEPENDENT
              key: 'fgate.netif.status[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Current link status of the interface.'
              valuemap:
                name: 'Link state'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.link
                - type: BOOL_TO_DECIMAL
                  parameters:
                    - ''
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
              trigger_prototypes:
                - uuid: e03715db2ab3447ba3dda0e07c3bc604
                  expression: '{$NET.IF.CONTROL:"{#IFNAME}"}=1 and last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])=1 and (last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#1)<>last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])<>1 or {$NET.IF.CONTROL:"{#IFNAME}"}=0'
                  name: 'Interface [{#IFNAME}({#IFALIAS})]: Link down'
                  opdata: 'Current status: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the interface link status is down.
                    2. `{$NET.IF.CONTROL:"{#IFNAME}"}=1` - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface link is down.
                    3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the interface link status was up to (1) sometime before.
                    
                    WARNING: If closed manually, it will not fire again on the next poll because of .diff.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: availability
            - uuid: ffba364bc78c446bb57f6673b7b6d255
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Interface type'
              type: DEPENDENT
              key: 'fgate.netif.type[{#IFKEY}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Type of the interface.'
              valuemap:
                name: 'Interface type'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.type
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'physical',
                      	'vlan',
                      	'aggregate',
                      	'redundant',
                      	'tunnel',
                      	'vdom-link',
                      	'loopback',
                      	'switch',
                      	'vap-switch',
                      	'wl-mesh',
                      	'fext-wan',
                      	'vxlan',
                      	'geneve',
                      	'hdlc',
                      	'switch-vlan',
                      	'emac-vlan',
                      	'ssl',
                      	'lan-extension'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 30;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.netif.get_data[{#IFKEY}]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFKEY}'
          trigger_prototypes:
            - uuid: b21dcb60f79d4d6686209ff4bb0d4dad
              expression: |
                change(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])<0 and last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])>0 
                and last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])<>0
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                (change(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])>0 and last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}],#2)>0) 
                or last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])=0
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Ethernet has changed to lower speed than it was before'
              opdata: 'Current reported speed: {ITEM.LASTVALUE1}'
              priority: INFO
              description: 'This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.'
              manual_close: 'YES'
              dependencies:
                - name: 'Interface [{#IFNAME}({#IFALIAS})]: Link down'
                  expression: '{$NET.IF.CONTROL:"{#IFNAME}"}=1 and last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])=1 and (last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#1)<>last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#2))'
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])<>1 or {$NET.IF.CONTROL:"{#IFNAME}"}=0'
              tags:
                - tag: scope
                  value: performance
            - uuid: 5aa7f2cacfc54b6eadfd9817b967725a
              expression: |
                (avg(/FortiGate by HTTP/fgate.netif.in[{#IFKEY}],15m)>({$NET.IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}]) or 
                avg(/FortiGate by HTTP/fgate.netif.out[{#IFKEY}],15m)>({$NET.IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])) 
                and last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])>0
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                avg(/FortiGate by HTTP/fgate.netif.in[{#IFKEY}],15m)<(({$NET.IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}]) 
                and avg(/FortiGate by HTTP/fgate.netif.out[{#IFKEY}],15m)<(({$NET.IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/FortiGate by HTTP/fgate.netif.speed[{#IFKEY}])
              name: 'Interface [{#IFNAME}({#IFALIAS})]: High bandwidth usage'
              event_name: 'Interface [{#IFNAME}({#IFALIAS})]: High bandwidth usage (>{$NET.IF.UTIL.MAX:"{#IFNAME}"}%)'
              opdata: 'In: {ITEM.LASTVALUE1}, out: {ITEM.LASTVALUE3}, speed: {ITEM.LASTVALUE2}'
              priority: WARNING
              description: 'The utilization of the network interface is close to its estimated maximum bandwidth.'
              manual_close: 'YES'
              dependencies:
                - name: 'Interface [{#IFNAME}({#IFALIAS})]: Link down'
                  expression: '{$NET.IF.CONTROL:"{#IFNAME}"}=1 and last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])=1 and (last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#1)<>last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}],#2))'
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.netif.status[{#IFKEY}])<>1 or {$NET.IF.CONTROL:"{#IFNAME}"}=0'
              tags:
                - tag: scope
                  value: performance
          graph_prototypes:
            - uuid: 5d5b2b5c35a7433999f29f4f22a6d380
              name: 'Interface [{#IFNAME}({#IFALIAS})]: Network traffic'
              graph_items:
                - drawtype: GRADIENT_LINE
                  color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.in[{#IFKEY}]'
                - sortorder: '1'
                  drawtype: BOLD_LINE
                  color: F63100
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.out[{#IFKEY}]'
                - sortorder: '2'
                  color: 00611C
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.in_errors[{#IFKEY}]'
                - sortorder: '3'
                  color: F7941D
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.out_errors[{#IFKEY}]'
                - sortorder: '4'
                  color: FC6EA3
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.in_packets[{#IFKEY}]'
                - sortorder: '5'
                  color: 6C59DC
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.netif.out_packets[{#IFKEY}]'
          master_item:
            key: fgate.netif.get_data
          lld_macro_paths:
            - lld_macro: '{#IFALIAS}'
              path: $.alias
            - lld_macro: '{#IFDESCR}'
              path: $.description
            - lld_macro: '{#IFKEY}'
              path: $.id
            - lld_macro: '{#IFNAME}'
              path: $.name
            - lld_macro: '{#IFSTATUS}'
              path: $.link
            - lld_macro: '{#IFTYPE}'
              path: $.type
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 6h
        - uuid: ededd6a88d74407c998f54a63bec5155
          name: 'SD-WAN health-checks discovery'
          type: DEPENDENT
          key: fgate.sdwan_health.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#IFNAME}'
                value: '{$SDWAN.HEALTH.IFNAME.MATCHES}'
                formulaid: A
              - macro: '{#IFNAME}'
                value: '{$SDWAN.HEALTH.IFNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#MID}'
                value: '{$SDWAN.HEALTH.ID.MATCHES}'
                formulaid: C
              - macro: '{#MID}'
                value: '{$SDWAN.HEALTH.ID.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#NAME}'
                value: '{$SDWAN.HEALTH.NAME.MATCHES}'
                formulaid: E
              - macro: '{#NAME}'
                value: '{$SDWAN.HEALTH.NAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
              - macro: '{#STATUS}'
                value: '{$SDWAN.HEALTH.STATUS.MATCHES}'
                formulaid: G
              - macro: '{#STATUS}'
                value: '{$SDWAN.HEALTH.STATUS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: H
          lifetime: 30d
          enabled_lifetime_type: DISABLE_NEVER
          description: 'Discovery for FortiGate SD-WAN health-checks.'
          item_prototypes:
            - uuid: 292228d1456f41b094b36edc2e22d24e
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Get data'
              type: DEPENDENT
              key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              delay: '0'
              history: '0'
              value_type: TEXT
              trends: '0'
              description: 'Item for gathering data about the {#IFNAME} interface in the {#NAME} health-check.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.data.health_data[?(@.q_origin_key == "{#HID}")]["{#IFNAME}"].first()'
                  error_handler: DISCARD_VALUE
              master_item:
                key: fgate.sdwan.get_data
              tags:
                - tag: component
                  value: raw
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 29802e18613a4f83a93b68e2aec72d6a
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Jitter'
              type: DEPENDENT
              key: 'fgate.sdwan_health.jitter["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              description: 'Current jitter value for the {#IFNAME} interface in the {#NAME} health-check.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.jitter
                  error_handler: DISCARD_VALUE
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 207b0b20629a4e4f89980c468b32d6af
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Latency'
              type: DEPENDENT
              key: 'fgate.sdwan_health.latency["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: ms
              description: 'Current latency value for the {#IFNAME} interface in the {#NAME} health-check.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.latency
                  error_handler: DISCARD_VALUE
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 02dee727fc0347f58266fb64646bd28f
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Packets loss'
              type: DEPENDENT
              key: 'fgate.sdwan_health.loss["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: '%'
              description: 'Percent of lost packets for the {#IFNAME} interface in the {#NAME} health-check.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.packet_loss
                  error_handler: DISCARD_VALUE
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
              trigger_prototypes:
                - uuid: 698f0a5da51f43359d917e296fa1a8c2
                  expression: 'min(/FortiGate by HTTP/fgate.sdwan_health.loss["{#HID}.{#MID}"],5m)>{$SDWAN.HEALTH.IF.LOSS.WARN:"{#IFNAME}"}'
                  name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: High packets loss'
                  opdata: 'Loss: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: 'High level of packets loss detected.'
                  tags:
                    - tag: scope
                      value: performance
            - uuid: b2eaa836c991459bab433edb2d27a968
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Packets received per second'
              type: DEPENDENT
              key: 'fgate.sdwan_health.received["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              description: 'Number of packets received from the {#IFNAME} interface in the {#NAME} health-check per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.packet_received
                  error_handler: DISCARD_VALUE
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 988c9785e5924a118efae469cf8ea017
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Packets sent per second'
              type: DEPENDENT
              key: 'fgate.sdwan_health.sent["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              description: 'Number of packets sent through the {#IFNAME} interface in the {#NAME} health-check per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.packet_sent
                  error_handler: DISCARD_VALUE
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 7ccc2ede10064b28877cd7ba9eba64b2
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Interface status'
              type: DEPENDENT
              key: 'fgate.sdwan_health.status["{#HID}.{#MID}"]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Current status of the {#IFNAME} interface in the {#NAME} health-check.'
              valuemap:
                name: 'Interface status'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.status
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'up',
                      	'down',
                      	'error'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 10;
              master_item:
                key: 'fgate.sdwan_health.get_data["{#HID}.{#MID}"]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: health_check
                  value: '{#NAME}'
                - tag: interface
                  value: '{#IFNAME}'
              trigger_prototypes:
                - uuid: c109ba19ca4d43bd87ffd0a4c9e64784
                  expression: '{$SDWAN.HEALTH.IF.CONTROL:"{#NAME}"}=1 and last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"])=1 and (last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"],#1)<>last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"])<>1 or {$SDWAN.HEALTH.IF.CONTROL:"{#NAME}"}=0'
                  name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Link down'
                  opdata: 'Current state: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the interface status is down.
                    2. `{$SDWAN.HEALTH.IF.CONTROL:"{#NAME}"}=1` - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down/error.
                    3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the interface status was up to (1) sometime before.
                    
                    WARNING: If closed manually, it will not fire again on the next poll because of .diff.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: availability
                - uuid: d2e5eea705ea470785eeea8145e75f0b
                  expression: '{$SDWAN.HEALTH.IF.CONTROL:"{#IFNAME}"}=1 and last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"])=2 and (last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"],#1)<>last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.sdwan_health.status["{#HID}.{#MID}"])<>2 or {$SDWAN.HEALTH.IF.CONTROL:"{#IFNAME}"}=0'
                  name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Link state is error'
                  opdata: 'Current state: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the interface status is error.
                    2. `{$SDWAN.HEALTH.IF.CONTROL:"{#IFNAME}"}=1` - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down/error.
                    3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the interface status was up to (1) sometime before.
                    
                    WARNING: If closed manually, it will not fire again on the next poll because of .diff.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: availability
          graph_prototypes:
            - uuid: 8e0ad9c4444b418fb0a632e4126470be
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Packets statistics'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_health.received["{#HID}.{#MID}"]'
                - sortorder: '1'
                  color: F63100
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_health.sent["{#HID}.{#MID}"]'
                - sortorder: '2'
                  drawtype: BOLD_LINE
                  color: 00611C
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_health.loss["{#HID}.{#MID}"]'
            - uuid: 11741f72e04a4c57a1183baee74ea396
              name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Performance'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_health.jitter["{#HID}.{#MID}"]'
                - sortorder: '1'
                  color: F63100
                  yaxisside: RIGHT
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_health.latency["{#HID}.{#MID}"]'
          master_item:
            key: fgate.sdwan.get_data
          lld_macro_paths:
            - lld_macro: '{#HID}'
              path: $.health_id
            - lld_macro: '{#IFNAME}'
              path: $.interface
            - lld_macro: '{#MID}'
              path: $.member_id
            - lld_macro: '{#NAME}'
              path: $.health_name
            - lld_macro: '{#STATUS}'
              path: $.status
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.health_lld
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: eccf64d732d44183866aae9bbdb394ba
          name: 'SD-WAN members discovery'
          type: DEPENDENT
          key: fgate.sdwan_member.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#ID}'
                value: '{$SDWAN.MEMBER.ID.MATCHES}'
                formulaid: A
              - macro: '{#ID}'
                value: '{$SDWAN.MEMBER.ID.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#NAME}'
                value: '{$SDWAN.MEMBER.NAME.MATCHES}'
                formulaid: C
              - macro: '{#NAME}'
                value: '{$SDWAN.MEMBER.NAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#STATUS}'
                value: '{$SDWAN.MEMBER.STATUS.MATCHES}'
                formulaid: E
              - macro: '{#STATUS}'
                value: '{$SDWAN.MEMBER.STATUS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
              - macro: '{#ZONE}'
                value: '{$SDWAN.MEMBER.ZONE.MATCHES}'
                formulaid: G
              - macro: '{#ZONE}'
                value: '{$SDWAN.MEMBER.ZONE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: H
          lifetime: 30d
          enabled_lifetime_type: DISABLE_NEVER
          description: 'Discovery for FortiGate SD-WAN members.'
          item_prototypes:
            - uuid: 376cf1ce322a4de5af3f86323f411b46
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Get data'
              type: DEPENDENT
              key: 'fgate.sdwan_member.get_data[{#ID}]'
              delay: '0'
              history: '0'
              value_type: TEXT
              trends: '0'
              description: 'Item for gathering data about the {#NAME} interface in the {#ZONE} zone.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.data.member_lld[?(@.interface == "{#NAME}")].first()'
                  error_handler: DISCARD_VALUE
              master_item:
                key: fgate.sdwan.get_data
              tags:
                - tag: component
                  value: raw
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: 937daa113f7d4d4d886cecdf0d5166b8
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Link status'
              type: DEPENDENT
              key: 'fgate.sdwan_member.link_status[{#ID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Current link status of the {#NAME} interface in the {#ZONE} zone.'
              valuemap:
                name: 'Interface status'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.link
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'up',
                      	'down',
                      	'error'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 10;
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
              trigger_prototypes:
                - uuid: 858488d06b6f482bbec954d38ad066b3
                  expression: '{$SDWAN.MEMBER.IF.CONTROL:"{#NAME}"}=1 and last(/FortiGate by HTTP/fgate.sdwan_member.link_status[{#ID}])=1 and (last(/FortiGate by HTTP/fgate.sdwan_member.link_status[{#ID}],#1)<>last(/FortiGate by HTTP/fgate.sdwan_member.link_status[{#ID}],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/FortiGate by HTTP/fgate.sdwan_member.link_status[{#ID}])<>1 or {$SDWAN.MEMBER.IF.CONTROL:"{#NAME}"}=0'
                  name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Link down'
                  opdata: 'Current state: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the interface status is down.
                    2. `{$SDWAN.MEMBER.IF.CONTROL:"{#NAME}"}=1` - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
                    3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the interface status was up to (1) sometime before.
                    
                    WARNING: If closed manually, it will not fire again on the next poll because of .diff.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: availability
            - uuid: 3fcdcefd280d4b9db61624e82df66871
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Input bandwidth'
              type: DEPENDENT
              key: 'fgate.sdwan_member.rx_bandwidth[{#ID}]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: Bps
              description: 'Receiving bandwidth of the {#NAME} interface in the {#ZONE} zone.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.rx_bandwidth
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: becb1fc1c07540d69490b08efc60847b
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Bytes received per second'
              type: DEPENDENT
              key: 'fgate.sdwan_member.rx_bytes[{#ID}]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: Bps
              description: 'Bytes received from the {#NAME} interface in the {#ZONE} zone per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.rx_bytes
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: 9b8c8717665c47de96af38b75ebca3fc
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Sessions'
              type: DEPENDENT
              key: 'fgate.sdwan_member.sessions[{#ID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Number of active sessions opened through the {#NAME} interface in the {#ZONE} zone.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.session
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: 86ee2100e0f349cf809afa171c6b985a
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Member status'
              type: DEPENDENT
              key: 'fgate.sdwan_member.status[{#ID}]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Current status of the {#NAME} interface in the {#ZONE} zone.'
              valuemap:
                name: 'Service status'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.status
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'enable',
                      	'disable'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 10;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: c5a29cbdfc1949d18b5b8490ba2230a9
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Output bandwidth'
              type: DEPENDENT
              key: 'fgate.sdwan_member.tx_bandwidth[{#ID}]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: Bps
              description: 'Transmitting bandwidth of the {#NAME} interface in the {#ZONE} zone.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.tx_bandwidth
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: c4e0c5747eee460b9a29d0d43d63e974
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Bytes sent per second'
              type: DEPENDENT
              key: 'fgate.sdwan_member.tx_bytes[{#ID}]'
              delay: '0'
              history: 7d
              value_type: FLOAT
              trends: 90d
              units: Bps
              description: 'Bytes sent through the {#NAME} interface in the {#ZONE} zone per second.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.tx_bytes
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
            - uuid: 908d970054e14c30aa0b33205f2a5ea8
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: State changing time'
              type: DEPENDENT
              key: 'fgate.service.state_changed[{#ID}]'
              delay: '0'
              history: 7d
              trends: 90d
              units: unixtime
              description: 'Last state changing time of the {#NAME} interface in the {#ZONE} zone.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.state_changed
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.sdwan_member.get_data[{#ID}]'
              tags:
                - tag: component
                  value: sd_wan
                - tag: interface
                  value: '{#NAME}'
                - tag: zone
                  value: '{#ZONE}'
          graph_prototypes:
            - uuid: 6de8957f4392467bb61f4b970a8073b2
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Bandwidth'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_member.tx_bandwidth[{#ID}]'
                - sortorder: '1'
                  color: F63100
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_member.rx_bandwidth[{#ID}]'
            - uuid: 25f114f8837b4b4f811725e035affb80
              name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Network traffic'
              graph_items:
                - drawtype: BOLD_LINE
                  color: 199C0D
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_member.tx_bytes[{#ID}]'
                - sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: F63100
                  item:
                    host: 'FortiGate by HTTP'
                    key: 'fgate.sdwan_member.rx_bytes[{#ID}]'
          master_item:
            key: fgate.sdwan.get_data
          lld_macro_paths:
            - lld_macro: '{#ID}'
              path: $.q_origin_key
            - lld_macro: '{#NAME}'
              path: $.interface
            - lld_macro: '{#STATUS}'
              path: $.status
            - lld_macro: '{#ZONE}'
              path: $.zone
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.data.member_lld
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: 5fe5e9dfee0448d7a6552c3c5ec9e72c
          name: 'Service discovery'
          type: DEPENDENT
          key: fgate.service.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#KEY}'
                value: '{$SERVICE.KEY.MATCHES}'
                formulaid: A
              - macro: '{#KEY}'
                value: '{$SERVICE.KEY.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#STATUS}'
                value: '{$SERVICE.STATUS.MATCHES}'
                formulaid: C
              - macro: '{#STATUS}'
                value: '{$SERVICE.STATUS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#TYPE}'
                value: '{$SERVICE.TYPE.MATCHES}'
                formulaid: E
              - macro: '{#TYPE}'
                value: '{$SERVICE.TYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
          lifetime: 30d
          enabled_lifetime_type: DISABLE_NEVER
          description: 'Discovery for FortiGate services.'
          item_prototypes:
            - uuid: c759d226d28143da977879550e913d5e
              name: 'Service [{#NAME}]: Expiration date'
              type: DEPENDENT
              key: 'fgate.service.expire["{#KEY}"]'
              delay: '0'
              history: 7d
              trends: 90d
              units: unixtime
              description: 'Expiration date for the license of the current service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.expires
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
              trigger_prototypes:
                - uuid: 4b921a823a5a4a2cbf35b140c26eb514
                  expression: '{$SERVICE.LICENSE.CONTROL:"{#KEY}"}=1 and (last(/FortiGate by HTTP/fgate.service.expire["{#KEY}"]) - now()) / 86400 < {$SERVICE.EXPIRY.WARN:"{#KEY}"} and last(/FortiGate by HTTP/fgate.service.expire["{#KEY}"]) > now()'
                  name: 'Service [{#NAME}]: License expires soon'
                  event_name: 'Service [{#NAME}]: License expires soon (less than {$SERVICE.EXPIRY.WARN:"{#KEY}"} days)'
                  opdata: 'Current expiration date: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the license expires soon.
                    2. `{$SERVICE.LICENSE.CONTROL:"{#IFNAME}"}=1` - a user can redefine context macro to value - 0. That marks the license of this service as not important. No new trigger will be fired if this license expires.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 84dd123ec16a4616bbf4d9a8c9ea9c8a
              name: 'Service [{#NAME}]: Get data'
              type: DEPENDENT
              key: 'fgate.service.get_data["{#KEY}"]'
              delay: '0'
              history: '0'
              value_type: TEXT
              trends: '0'
              description: 'Item for gathering data about license for the {#NAME} service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.data["{#KEY}"]'
                  error_handler: DISCARD_VALUE
              master_item:
                key: fgate.service.get_data
              tags:
                - tag: component
                  value: raw
                - tag: service
                  value: '{#KEY}'
            - uuid: d2e2c614e1dd428caa251b77d9a24f9a
              name: 'Service [{#NAME}]: License status'
              type: DEPENDENT
              key: 'fgate.service.license["{#KEY}"]'
              delay: '0'
              history: 7d
              trends: 90d
              description: 'Current license status of the {#NAME} service.'
              valuemap:
                name: 'License status'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.status
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'cloud_logged_in',
                      	'licensed',
                      	'registered',
                      	'vm_eval',
                      	'free_license',
                      	'vm_valid',
                      	'cloud_confirm_email',
                      	'cloud_error',
                      	'cloud_logged_out',
                      	'cloud_login_in_progress',
                      	'expired',
                      	'expires_soon',
                      	'free_license_exhausted',
                      	'licensed_exhausted',
                      	'no_license',
                      	'no_support',
                      	'not_registered',
                      	'pending',
                      	'unavailable',
                      	'update_manual',
                      	'update_push',
                      	'update_sched',
                      	'vm_eval_expired',
                      	'vm_expired',
                      	'vm_expires_soon',
                      	'vm_grace_period',
                      	'vm_invalid',
                      	'vm_pending',
                      	'vm_validation_overdue',
                      ].indexOf(value);
                      return idx !== -1 ? idx : 30;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
              trigger_prototypes:
                - uuid: ad27092f227545d48f550bb58e61dd4c
                  expression: '{$SERVICE.LICENSE.CONTROL:"{#KEY}"}=1 and last(/FortiGate by HTTP/fgate.service.license["{#KEY}"])>5'
                  name: 'Service [{#NAME}]: License status is unsuccessful'
                  event_name: 'Service [{#NAME}]: License status is {ITEM.LASTVALUE1}'
                  opdata: 'Current status: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. It can be triggered if the license status is unsuccessful.
                    2. `{$SERVICE.LICENSE.CONTROL:"{#IFNAME}"}=1` - a user can redefine context macro to value - 0. That marks the license of this service as not important. No new trigger will be fired if this license is unsuccessful.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 89eb7360f2f846aabca21c63a05866ca
              name: 'Service [{#NAME}]: Service type'
              type: DEPENDENT
              key: 'fgate.service.type["{#KEY}"]'
              delay: '0'
              history: 7d
              value_type: CHAR
              trends: '0'
              description: 'Current type of the {#NAME} service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.type
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
            - uuid: 160afd9220c9445f943142e356253626
              name: 'Service [{#NAME}]: Last attempt to update'
              type: DEPENDENT
              key: 'fgate.service.update_attempt["{#KEY}"]'
              delay: '0'
              history: 7d
              trends: 90d
              units: unixtime
              description: 'Last update attempt time of the current service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.last_update_attempt
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
            - uuid: 9abd3d1e858b413bb84c76a77fb0764b
              name: 'Service [{#NAME}]: Update method'
              type: DEPENDENT
              key: 'fgate.service.update_method["{#KEY}"]'
              delay: '0'
              history: 7d
              value_type: CHAR
              trends: '0'
              description: 'Current update method of the {#NAME} service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.last_update_method_status
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
            - uuid: a19764a51d4941bd877a24accac2b8b3
              name: 'Service [{#NAME}]: Update result'
              type: DEPENDENT
              key: 'fgate.service.update_result["{#KEY}"]'
              delay: '0'
              history: 7d
              value_type: CHAR
              trends: '0'
              description: 'Last update result of the {#NAME} service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.last_update_result_status
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
            - uuid: d31db33d6ca34264a7480dacee235081
              name: 'Service [{#NAME}]: Last update time'
              type: DEPENDENT
              key: 'fgate.service.update_time["{#KEY}"]'
              delay: '0'
              history: 7d
              trends: 90d
              units: unixtime
              description: 'Last update time of the current service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.last_update
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
            - uuid: 5f395038deb643ed83823695c4475d9e
              name: 'Service [{#NAME}]: Service version'
              type: DEPENDENT
              key: 'fgate.service.version["{#KEY}"]'
              delay: '0'
              history: 7d
              value_type: CHAR
              trends: '0'
              description: 'Current version of the {#NAME} service.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.version
                  error_handler: DISCARD_VALUE
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'fgate.service.get_data["{#KEY}"]'
              tags:
                - tag: component
                  value: service
                - tag: name
                  value: '{#KEY}'
          master_item:
            key: fgate.service.get_data
          lld_macro_paths:
            - lld_macro: '{#KEY}'
              path: $.key
            - lld_macro: '{#NAME}'
              path: $.name
            - lld_macro: '{#STATUS}'
              path: $.status
            - lld_macro: '{#TYPE}'
              path: $.type
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.lld
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 6h
          overrides:
            - name: 'System services'
              step: '1'
              filter:
                conditions:
                  - macro: '{#TYPE}'
                    value: ^(cloud_service_status|platform|other)$
                    formulaid: A
              operations:
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Expiration date'
                  discover: NO_DISCOVER
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Last attempt to update'
                  discover: NO_DISCOVER
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Last update time'
                  discover: NO_DISCOVER
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Service version'
                  discover: NO_DISCOVER
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Update method'
                  discover: NO_DISCOVER
                - operationobject: ITEM_PROTOTYPE
                  operator: LIKE
                  value: ': Update result'
                  discover: NO_DISCOVER
      tags:
        - tag: class
          value: network
        - tag: target
          value: fortigate
        - tag: target
          value: fortinet
      macros:
        - macro: '{$CPU.UTIL.CRIT}'
          value: '95'
          description: 'Threshold of CPU utilization for critical trigger in %.'
        - macro: '{$CPU.UTIL.WARN}'
          value: '85'
          description: 'Threshold of CPU utilization for warning trigger in %.'
        - macro: '{$DISK.FREE.CRIT}'
          value: '10'
          description: 'Threshold of disk free space for critical trigger in %.'
        - macro: '{$DISK.FREE.WARN}'
          value: '20'
          description: 'Threshold of disk free space for warning trigger in %.'
        - macro: '{$FGATE.API.FQDN}'
          description: 'FortiGate API FQDN/IP (ex. ngfw.example.com).'
        - macro: '{$FGATE.API.PORT}'
          value: '80'
          description: 'The port of FortiGate API endpoint.'
        - macro: '{$FGATE.API.TOKEN}'
          type: SECRET_TEXT
          description: 'FortiGate API token.'
        - macro: '{$FGATE.DATA.TIMEOUT}'
          value: 15s
          description: 'Response timeout for an API.'
        - macro: '{$FGATE.HTTP.PROXY}'
          description: 'HTTP proxy for API requests. You can specify it using the format [protocol://][username[:password]@]proxy.example.com[:port]. See the documentation at https://www.zabbix.com/documentation/6.4/manual/config/items/itemtypes/http'
        - macro: '{$FGATE.SCHEME}'
          value: http
          description: 'Request scheme which may be http or https.'
        - macro: '{$FIRMWARE.UPDATES.CONTROL}'
          value: '1'
          description: 'This macro is used in "New available firmware found" trigger.'
        - macro: '{$FWP.FWACTION.MATCHES}'
          value: '.*'
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$FWP.FWACTION.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$FWP.FWNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$FWP.FWNAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$FWP.FWTYPE.MATCHES}'
          value: '.*'
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$FWP.FWTYPE.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.'
        - macro: '{$MEMORY.UTIL.CRIT}'
          value: '90'
          description: 'Threshold of memory utilization for critical trigger in %.'
        - macro: '{$MEMORY.UTIL.WARN}'
          value: '80'
          description: 'Threshold of memory utilization for warning trigger in %.'
        - macro: '{$NET.IF.CONTROL}'
          value: '1'
          description: 'Macro for operational state of the interface for "Link down" trigger. Can be used with interface name as context.'
        - macro: '{$NET.IF.ERRORS.WARN}'
          value: '2'
          description: 'Threshold of error packets rate for warning trigger. Can be used with interface name as context.'
        - macro: '{$NET.IF.IFALIAS.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFALIAS.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFDESCR.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFDESCR.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFNAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFSTATUS.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFSTATUS.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFTYPE.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFTYPE.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.UTIL.MAX}'
          value: '95'
          description: 'Threshold of interface bandwidth utilization for warning trigger in %. Can be used with interface name as context.'
        - macro: '{$SDWAN.HEALTH.ID.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.ID.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.IF.CONTROL}'
          value: '1'
          description: 'Macro for the interface state for "Link down" trigger. Can be used with interface name as context.'
        - macro: '{$SDWAN.HEALTH.IF.LOSS.WARN}'
          value: '20'
          description: 'Threshold of packets loss for warning trigger in %. Can be used with interface name as context.'
        - macro: '{$SDWAN.HEALTH.IFNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.IFNAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.NAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.NAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.STATUS.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.HEALTH.STATUS.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.ID.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.ID.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.IF.CONTROL}'
          value: '1'
          description: 'Macro for the interface state for "Link down" trigger. Can be used with interface name as context.'
        - macro: '{$SDWAN.MEMBER.NAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.NAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.STATUS.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.STATUS.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.ZONE.MATCHES}'
          value: '.*'
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SDWAN.MEMBER.ZONE.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.EXPIRY.WARN}'
          value: '7'
          description: 'Number of days until the license expires.'
        - macro: '{$SERVICE.KEY.MATCHES}'
          value: '.*'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.KEY.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.LICENSE.CONTROL}'
          value: '1'
          description: 'This macro is used in Service discovery. Can be used with interface name as context.'
        - macro: '{$SERVICE.STATUS.MATCHES}'
          value: '.*'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.STATUS.NOT_MATCHES}'
          value: (no_support|no_license)
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.TYPE.MATCHES}'
          value: '.*'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.TYPE.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
      dashboards:
        - uuid: a1c7206d9312486b9d09dc9ef34ed98e
          name: 'FortiGate: General'
          pages:
            - name: Overview
              widgets:
                - type: item
                  name: 'Port availability'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: 'net.tcp.service["{$FGATE.SCHEME}","{$FGATE.API.FQDN}","{$FGATE.API.PORT}"]'
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: Name
                  'y': '3'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.name
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: Firmware
                  'y': '6'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.device.firmware
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: 'API availability'
                  x: '24'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.api.status
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: Model
                  x: '24'
                  'y': '3'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.device.model
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: 'Virtual Domain'
                  x: '24'
                  'y': '6'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.device.vdom
                    - type: INTEGER
                      name: show
                      value: '2'
                    - type: INTEGER
                      name: show
                      value: '4'
                - type: item
                  name: Uptime
                  x: '48'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.uptime
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: 'Serial Number'
                  x: '48'
                  'y': '3'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.device.serialnumber
                    - type: INTEGER
                      name: show
                      value: '2'
                - type: item
                  name: 'Number of CPUs'
                  x: '48'
                  'y': '6'
                  width: '24'
                  height: '3'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'FortiGate by HTTP'
                        key: fgate.cpu.num
                    - type: INTEGER
                      name: show
                      value: '2'
            - name: 'System performance'
              widgets:
                - type: graph
                  width: '36'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FortiGate: CPU utilization'
                    - type: STRING
                      name: reference
                      value: AAATY
                - type: graph
                  'y': '5'
                  width: '36'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FortiGate: Disk usage'
                    - type: STRING
                      name: reference
                      value: AAATZ
                - type: graph
                  x: '36'
                  width: '36'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FortiGate: Memory utilization'
                    - type: STRING
                      name: reference
                      value: AAAUA
                - type: graph
                  x: '36'
                  'y': '5'
                  width: '36'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FortiGate: Disk utilization'
                    - type: STRING
                      name: reference
                      value: AAAUB
            - name: 'SD-WAN statistics'
              widgets:
                - type: graphprototype
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Network traffic'
                    - type: STRING
                      name: reference
                      value: AAAUC
                - type: graphprototype
                  'y': '5'
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Packets statistics'
                    - type: STRING
                      name: reference
                      value: AAAUD
                - type: graphprototype
                  x: '36'
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'SD-WAN [{#ZONE}]:[{#NAME}]: Bandwidth'
                    - type: STRING
                      name: reference
                      value: AAAUE
                - type: graphprototype
                  x: '36'
                  'y': '5'
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'SD-WAN [{#NAME}]:[{#IFNAME}]: Performance'
                    - type: STRING
                      name: reference
                      value: AAAUF
            - name: 'Firewall statistics'
              widgets:
                - type: graphprototype
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FW Policy [{#FWNAME}]: Active sessions'
                    - type: STRING
                      name: reference
                      value: AAAUG
                - type: graphprototype
                  'y': '5'
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FW Policy [{#FWNAME}]: Policy processing'
                    - type: STRING
                      name: reference
                      value: AAAUH
                - type: graphprototype
                  x: '36'
                  width: '36'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'FW Policy [{#FWNAME}]: Hits into the policy'
                    - type: STRING
                      name: reference
                      value: AAAUI
            - name: 'Network interfaces'
              widgets:
                - type: graphprototype
                  width: '72'
                  height: '7'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'FortiGate by HTTP'
                        name: 'Interface [{#IFNAME}({#IFALIAS})]: Network traffic'
                    - type: STRING
                      name: reference
                      value: AAAUJ
      valuemaps:
        - uuid: 8b0c51b152b04ba690cd13e43a2c90d9
          name: 'Firewall policy action'
          mappings:
            - value: '0'
              newvalue: accept
            - value: '1'
              newvalue: deny
            - value: '2'
              newvalue: ipsec
            - value: '10'
              newvalue: unknown
        - uuid: 2285b34278df448ab2ba2276913c0b77
          name: 'Firewall policy status'
          mappings:
            - value: '0'
              newvalue: enable
            - value: '1'
              newvalue: disable
        - uuid: 7aa1df8cbdda4d3aa5bad0af95733a06
          name: 'Interface status'
          mappings:
            - value: '0'
              newvalue: up
            - value: '1'
              newvalue: down
            - value: '2'
              newvalue: error
            - value: '10'
              newvalue: unknown
        - uuid: 6d6a2211c6e64ecfb00838886750912b
          name: 'Interface type'
          mappings:
            - value: '0'
              newvalue: physical
            - value: '1'
              newvalue: vlan
            - value: '2'
              newvalue: aggregate
            - value: '3'
              newvalue: redundant
            - value: '4'
              newvalue: tunnel
            - value: '5'
              newvalue: vdom-link
            - value: '6'
              newvalue: loopback
            - value: '7'
              newvalue: switch
            - value: '8'
              newvalue: vap-switch
            - value: '9'
              newvalue: wl-mesh
            - value: '10'
              newvalue: fext-wan
            - value: '11'
              newvalue: vxlan
            - value: '12'
              newvalue: geneve
            - value: '13'
              newvalue: hdlc
            - value: '14'
              newvalue: switch-vlan
            - value: '15'
              newvalue: emac-vlan
            - value: '16'
              newvalue: ssl
            - value: '17'
              newvalue: lan-extension
            - value: '30'
              newvalue: unknown
        - uuid: 0e225b17b2e543f18fea31366d9b6286
          name: 'License status'
          mappings:
            - value: '0'
              newvalue: Activated
            - value: '1'
              newvalue: Licensed
            - value: '2'
              newvalue: Registered
            - value: '3'
              newvalue: 'Evaluation License'
            - value: '4'
              newvalue: 'Free License'
            - value: '5'
              newvalue: Valid
            - value: '6'
              newvalue: 'Activation Pending (View Confirmation Email)'
            - value: '7'
              newvalue: 'Error Logging In'
            - value: '8'
              newvalue: 'Not Activated'
            - value: '9'
              newvalue: 'Login in Progress'
            - value: '10'
              newvalue: Expired
            - value: '11'
              newvalue: 'Expires Soon'
            - value: '12'
              newvalue: 'Free License (exhausted)'
            - value: '13'
              newvalue: 'Licensed (exhausted)'
            - value: '14'
              newvalue: 'Not Licensed'
            - value: '15'
              newvalue: 'Not Supported'
            - value: '16'
              newvalue: 'Not Registered'
            - value: '17'
              newvalue: Pending
            - value: '18'
              newvalue: Unavailable
            - value: '19'
              newvalue: 'Manual Update'
            - value: '20'
              newvalue: 'Push Update'
            - value: '21'
              newvalue: 'Scheduled Update'
            - value: '22'
              newvalue: Expired
            - value: '23'
              newvalue: Expired
            - value: '24'
              newvalue: 'Expires Soon'
            - value: '25'
              newvalue: 'Grace Period'
            - value: '26'
              newvalue: Invalid
            - value: '27'
              newvalue: 'Validation in Progress'
            - value: '28'
              newvalue: 'Validation Overdue'
            - value: '30'
              newvalue: Unknown
        - uuid: 76ac7f91b2184689b19dc838cde49ade
          name: 'Link state'
          mappings:
            - value: '0'
              newvalue: down
            - value: '1'
              newvalue: up
        - uuid: 176db78d3aa34c92893300d56eda5737
          name: 'Service state'
          mappings:
            - value: '0'
              newvalue: down
            - value: '1'
              newvalue: up
        - uuid: 3b62f79c5a664465897a372e833af713
          name: 'Service status'
          mappings:
            - value: '0'
              newvalue: enable
            - value: '1'
              newvalue: disable
            - value: '10'
              newvalue: unknown
  graphs:
    - uuid: e7cf2dc608fb463594298f1c710ba435
      name: 'FortiGate: CPU utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - color: 199C0D
          item:
            host: 'FortiGate by HTTP'
            key: fgate.cpu.util
    - uuid: 1f88c77c5e7f4886af17fa7f3fea69b9
      name: 'FortiGate: Disk usage'
      graph_items:
        - color: 199C0D
          item:
            host: 'FortiGate by HTTP'
            key: fgate.fs.total
        - sortorder: '1'
          color: F63100
          item:
            host: 'FortiGate by HTTP'
            key: fgate.fs.used
        - sortorder: '2'
          color: 00611C
          item:
            host: 'FortiGate by HTTP'
            key: fgate.fs.free
    - uuid: d2419e09ca7a46388a3b7876e1eea09f
      name: 'FortiGate: Disk utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - color: 199C0D
          item:
            host: 'FortiGate by HTTP'
            key: fgate.fs.util
    - uuid: 25a31e8022864e8e95cb6587f3eefdb3
      name: 'FortiGate: Memory utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - color: 199C0D
          item:
            host: 'FortiGate by HTTP'
            key: fgate.memory.util
