SATOM — System Automation & Task Orchestration Manager

Why SATOM

Everything the console does — plus what it can't

The database, audit trail, git history and automation that the appliances themselves don't offer.

🗂️

Git source of truth

Every device's configuration is harvested on schedule and versioned in git — drift detection, A→B diff viewer and point-in-time restore included.

🔁

HA by design

Two-node active/standby clustering with TLS-enforced PostgreSQL streaming replication is built into the installer — the secondary joins with one pasted key.

🧩

One editor, ~500 endpoints

A spec-driven form engine edits any registry endpoint with stacked slide-over panels, create-references-in-place and dry-run previews on every write.

🧯

Defense-in-depth backups

Live database, portable bundles, git-versioned device configs and an external SFTP server — four independent copies across failure domains.

⏱️

Change control

Scheduled actions, Change Requests with maintenance-window approval gates, and background jobs with pause / resume / stop.

🔐

Security first

Two-factor login, role-based access, per-channel encryption monitoring and a hardened deployment profile out of the box.

The console

See it in action

A light enterprise console — navy chrome, per-ADOM color coding, one workspace per Fortinet product line.

SATOM dashboard — **Dashboard**Fleet health & device status at a glance

FortiWeb signatures — **Signatures**FortiWeb WAF signatures & guided exceptions

Policy templates — **Templates**Reusable policy templates with locks & clone/migrate

**Object editor**Spec-driven editing for ~500 registry endpoints

Device sync & git history — **Device sync**Scheduled harvest & git-versioned source of truth

Backup coverage & HA — **Backups & HA**Four-copy backup coverage matrix & cluster status

How it works

The manager ↔ device sync, in five steps

A read path that keeps the database and git in lock-step with the live appliances — and a minimal-diff write path back.

1

Schedule

Hourly sync + nightly inspect, per product

2

Harvest

REST API, SSH/CLI fallback

3

Normalize

One snapshot shape per device

4

Cache

PostgreSQL device store

5

Version

JSON tree committed to git

↩️

Writes go the other way, minimally. When you save an object, only the fields you changed are pushed to the device — with a dry-run preview and a full audit entry.

See the full sync model →

Supported devices

Three Fortinet product lines, one console

FortiWeb

Web Application Firewall

Server policies, WAF signatures & exceptions
166 curated Web Protection object kinds
Config backup over REST + SSH/CLI

REST · SSH · tested on 7.6.x

FortiADC

Application Delivery Controller

Virtual servers, real-server pools, LB objects
Certificate deploy over REST
Harvested into the same git source of truth

REST · self-signed aware

FortiAnalyzer

Logging & Analytics

Full JSON-RPC, both API dialects
Device Manager & live registry menu
Config snapshot in git (~3.5k objects)

JSON-RPC · tested on 7.6.7

Deploy

Run it anywhere Linux runs

One interactive installer with online and air-gapped modes, for Debian and RHEL families.

OnlineAny distro family

Connected install

Detects apt, dnf/yum, zypper or pacman and maps package names per family. Prompts for IP, port, admin password and standalone / cluster mode.

# as root on a fresh host
./install-satom.sh

OfflineDebian 12RHEL 9

Air-gapped install

Self-contained bundles — OS packages, Python wheels and the application — for hosts with no internet access. Auto-detected when bundle/ is present.

tar xzf satom-offline-<ver>-<family>.tar.gz
cd satom-installer && ./install-satom.sh