Fortinet FortiManager extension

• Latest Dynatrace
• Extension
• Published Oct 28, 2026

Monitor Fortinet FortiManager managed devices, configuration sync, policy packages, change tasks, and appliance health with Smartscape topology.

Get started

Overview

The Fortinet FortiManager extension ingests the management-plane state from a Fortinet FortiManager. The extension runs as a Python extension on an ActiveGate and polls the FortiManager JSON-RPC API (POST /jsonrpc), authenticating with an API token, a username and password session, or, for FortiManager Cloud, the FortiCloud SSO exchange.

The extension bundles its own data source: the Python collector runs on the ActiveGate and retrieves the data from FortiManager. On the FortiManager side, you only need to create a read-only API administrator (or, for FortiManager Cloud, a FortiCloud IAM API user) and enter its credentials in the monitoring configuration.

FortiManager manages the firewalls from the management plane, so it stores state that no individual device can report about itself. On each collection cycle, the extension authenticates and issues the JSON-RPC get requests for every enabled feature set. It then:

The extension reads the following JSON-RPC resources:

By default, the real-time tier runs every 60 seconds and the standard tier every 300 seconds. You can change both intervals; see Create the monitoring configuration.

Use cases

Requirements

FortiManager permissions

Don't grant Read-Write; the extension doesn't need it.

When you save the monitoring configuration, the extension validates only connectivity, authentication, the permissions behind the system status and ADOM list reads, and the ADOM scope. If another permission is missing, FortiManager returns a permission error (HTTP 403 or JSON-RPC code -11). The extension logs which admin profile section to grant and reports a non-OK endpoint status for that feature set. It continues collecting all other data.

Compatibility information

The extension works with the FortiManager JSON-RPC API and provides ready-made metrics, topology, logs, dashboards, and alert templates for the following data groups:

For these data groups, everything is ready to use from the moment you save a monitoring configuration. The feature sets and log toggles you enable, the admin profile you grant, and the ADOM scope you set determine which data groups reach Dynatrace and how much the collection costs.

Note the following constraints:

Activation and setup

Activation has four parts: activate the extension from Dynatrace Hub, create the FortiManager API account, create the monitoring configuration, and verify that data arrives. The prerequisites are listed under Requirements.

config system admin profile
    edit "dynatrace_ro"
        set system-setting read
        set adom-switch read
        set device-manager read
        set adom-policy-packages read
        set event-management read     # only when the Alert events toggle is on
    next
end

Details

The Fortinet FortiManager extension collects metrics, topology, and log data for:

Metrics are reported under the fortimanager.* namespace. The appliance's CPU, memory, and interfaces are also reported under the platform's com.dynatrace.extension.network_device.* namespace, so its built-in network device page is populated.

The default feature set is always on and reports appliance connectivity, system status, interfaces, CPU, memory, and disk, the ADOM count, and managed devices per ADOM and connection state. The other feature sets are opt-in per monitoring configuration:

For the metrics in each feature set, see Feature sets.

The Fortinet FortiManager extension is packaged with:

Smartscape on Grail

The extension builds its topology on Smartscape on Grail only. Instead of shipping a static topology, the bundled Fortinet FortiManager Smartscape Metrics Pipeline extracts nodes and edges from the fortimanager.* metrics as they arrive, so the topology reflects changes as ADOMs, packages, and cluster members are added or removed.

The extension creates an EXT_NETWORK_DEVICE node for the FortiManager appliance and an EXT_NETWORK_INTERFACE node for each of its own interfaces, plus FORTIMANAGER_ADOM, FORTIMANAGER_POLICY_PACKAGE, and FORTIMANAGER_HA_MEMBER nodes. The extension adds belongs_to static edges from each interface and each ADOM to the appliance, and from each policy package and each HA member to its ADOM.

The metrics source is statically routed to that pipeline, so you don't need to configure anything: the nodes populate automatically once the first collection cycles complete. Allow a few minutes.

To explore the topology, open Smartscape, or Infrastructure & Operations > Network devices for the appliance. Filter for the FortiManager node types, and select an entity to explore its connections.

Unified analysis screens

Each FortiManager entity type has an inventory list and an entity details view. You can reach them from Infrastructure & Operations > Network > Fortinet FortiManager, by selecting the entity in Smartscape, or through global search.

Each inventory screen lists every entity of that type with its health alerts and current counts. Each entity details screen opens on an Overview tab of current state, backed by a Properties tab of the entity's attributes.

Tabs whose data isn't collected are hidden instead of shown empty. These screens require Smartscape on Grail, so they're subject to the minimum Dynatrace version in Requirements.

Logs

Beyond metrics, the extension sends structured log streams to Grail. Logs carry the per-task, per-revision, and per-alert detail that would otherwise inflate metric cardinality, and they stay queryable with DQL.

Every record carries timestamp, log.source, severity, content, and configuration_label, plus the primary tags and fields of the monitoring configuration and the fields listed for each stream. The extension keeps change detection state in memory, so the first cycle after an extension restart behaves as described for each stream.

The Task Activity dashboard reads fortimanager.task_monitor, and the Policy & ADOMs dashboard reads fortimanager.system_config. fortimanager.alert_events is available for ad-hoc DQL queries in Notebooks and Logs.

Rate limiting and error handling

Fortinet publishes no rate limit for the FortiManager JSON-RPC API, so the extension limits its request rate: at most four requests in flight and at least 0.1 seconds between requests against one FortiManager, with reads for several ADOMs batched into one request where the API allows it.

A failed endpoint skips that cycle for its feature set only: the extension reports a non-OK endpoint status, and the other collectors keep running. Session and FortiManager Cloud modes sign out at the end of every cycle, so the extension never occupies a session slot between cycles. Token mode uses no session slots.

Licensing and costs

There is no charge to use the extension. You are only charged for the data that the extension ingests.

The extension polls the FortiManager JSON-RPC API and reports custom metrics from the responses. The metrics consume Davis Data Units (DDUs) (Dynatrace classic license) or Metrics powered by Grail (DPS), according to your license model. The log streams are billed separately, as log ingest and retention.

Dynatrace Platform Subscription

In the Dynatrace Platform Subscription, metric ingestion consumes Metrics powered by Grail according to the number of ingested metric data points.

The following formula provides approximate data points ingested per year, assuming all feature sets are enabled and the default collection intervals are used.

(
    (  1 unique managed-device rollup metric * dimension combinations )       -- default, real time (every 1 min)
  + ( 11 unique appliance metrics          * dimension combinations ) / 5     -- default, standard  (every 5 min)
  + (  5 unique device metrics             * dimension combinations )         -- device_management  (every 1 min)
  + (  2 unique policy package metrics     * dimension combinations ) / 5     -- policy_packages    (every 5 min)
  + (  1 unique task metric                * dimension combinations ) / 5     -- tasks              (every 5 min)
  + (  2 unique ADOM inventory metrics     * dimension combinations )         -- adom_inventory     (every 1 min)
  + (  5 unique self-monitoring metrics    * dimension combinations ) / 5     -- self_monitoring    (every 5 min)
) * 60 minutes * 24 hours * 365 days data points per year

A "dimension combination" is a distinct set of values across a metric's dimensions. Omit any line for a feature set you don't enable.

In practice, each combination maps to one real object—the appliance, an appliance interface, an ADOM, a managed device, an HA member, a policy package target, or a task transition—because every metric carries an identity dimension. Cost therefore scales with the size of the managed estate, not with the number of FortiManager appliances:

The log streams add one record per changed or in-progress task per standard cycle, one per new configuration revision, and one per new or changed FortiAnalyzer alert.

Dynatrace classic license

In the classic licensing model, metric ingestion consumes Davis Data Units (DDUs) at the rate of .001 DDUs per metric data point. Multiply the above formula for annual data points by .001 to estimate annual DDU usage.

The DDU cost above doesn't include the log records ingested by the log streams, or any problems and custom events raised by the alert templates. For more information, see DDUs for custom Davis events.

Feature sets

When activating your extension using a monitoring configuration, you can limit monitoring to one of the feature sets. To work properly, the extension has to collect at least one metric after the activation.

In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.

All metrics that aren't categorized into any feature set are considered to be the default and are always reported.

FAQ

Explore in Dynatrace Hub

Monitor Fortinet FortiManager managed devices, configuration sync, policy packages, change tasks, and appliance health with Smartscape topology.