get_pcap_file
Download PCAP file for an IPS event
How to use it
Project documentation lists get_pcap_file for the Fortianalyzer MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.
Install Fortianalyzer MCP
pip install -e .Other tools in Fortianalyzer MCP (39)
Add a new device to FortiAnalyzer
Add multiple devices at once
Release a pagination handle
Remove a device from FortiAnalyzer
Remove multiple devices at once
Fetch FortiView query results
Fetch another page for a querylogs handle (re-runs the query at a new offset)
Check report generation status
Get specific ADOM details
Get security alerts
Get API rate limiting configuration (FAZ 7.6.5+)
Get specific device information
Get detailed device information
Run FortiView and get results (auto-wait)
Get High Availability cluster status
Get available log fields for a log type
Check log search progress
Get log statistics
Get log file state information
Download completed report data
Get report generation history
List currently running reports
Get FortiAnalyzer system status and version info
Get task details by ID
List all Administrative Domains
List device groups in an ADOM
List VDOMs for a device
List devices in an ADOM
List available report layouts
List available report templates
List background tasks
Query logs, or aggregate them: rows plus a reusable pagination handle, or groupby / sampleby / countonly (see below)
Run report and wait for completion
Start a FortiView analytics query
Start a report generation
Download and save report to disk
Search devices with filters
Update API rate limits (FAZ 7.6.5+)
Wait for a task to complete