n8n-nodes-fortisiem 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 kboykov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,267 @@
+# n8n-nodes-fortisiem
+
+An [n8n](https://n8n.io/) community node for [FortiSIEM](https://www.fortinet.com/products/siem/fortisiem) — Fortinet's security information and event management (SIEM) platform for real-time monitoring, analytics, and incident management.
+
+This node lets you interact with the FortiSIEM REST API directly from your n8n workflows: fetch and update incidents, retrieve triggering events, run analytic event queries, manage monitored organizations, and maintain watchlists.
+
+[![npm version](https://img.shields.io/npm/v/n8n-nodes-fortisiem.svg)](https://www.npmjs.com/package/n8n-nodes-fortisiem)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![n8n community node](https://img.shields.io/badge/n8n-community--node-orange)](https://docs.n8n.io/integrations/community-nodes/)
+
+---
+
+## Table of Contents
+
+- [Features](#features)
+- [Prerequisites](#prerequisites)
+- [Installation](#installation)
+- [Credentials](#credentials)
+- [Resources & Operations](#resources--operations)
+  - [Incident](#incident)
+  - [Event](#event)
+  - [Organization](#organization)
+  - [Watchlist](#watchlist)
+- [Usage Examples](#usage-examples)
+- [Development](#development)
+- [Publishing to npm](#publishing-to-npm)
+- [Compatibility](#compatibility)
+- [License](#license)
+
+---
+
+## Features
+
+- **13 operations** across 4 FortiSIEM resource types
+- HTTP Basic authentication with built-in credential testing
+- Automatic JSON parsing of FortiSIEM's `text/plain` responses
+- Optional "Ignore SSL Issues" toggle for self-signed appliance certificates
+- `continueOnFail` support — process remaining items even when one fails
+- Compatible with n8n's **AI Tool** interface (`usableAsTool: true`)
+- Full TypeScript source with strict mode enabled
+
+---
+
+## Prerequisites
+
+| Requirement | Version |
+|---|---|
+| n8n | ≥ 1.0.0 |
+| FortiSIEM | ≥ 6.x (REST API, `/phoenix/rest`) |
+| Node.js | ≥ 18.x |
+
+---
+
+## Installation
+
+### Via n8n UI (recommended)
+
+1. Open n8n → **Settings** → **Community Nodes**
+2. Click **Install**
+3. Enter `n8n-nodes-fortisiem` and confirm
+
+### Via npm (self-hosted)
+
+```bash
+npm install n8n-nodes-fortisiem
+```
+
+Then restart your n8n instance.
+
+---
+
+## Credentials
+
+Create a **FortiSIEM API** credential with the following fields:
+
+| Field | Description | Example |
+|---|---|---|
+| **Base URL** | Base URL of your FortiSIEM Supervisor (no trailing slash) | `https://fortisiem.example.com` |
+| **Username** | API user as `<organization>/<user>` | `super/admin` |
+| **Password** | Account password | `••••••••` |
+| **Ignore SSL Issues (Insecure)** | Connect even if the TLS certificate fails validation | `true` for self-signed certs |
+
+The node authenticates every request using HTTP Basic auth. Click **Test connection** on the credential card to verify connectivity — this calls `GET /phoenix/rest/config/Domain` (list monitored organizations).
+
+> **Tip:** Create a dedicated FortiSIEM API user with the minimum required role for your workflows.
+
+---
+
+## Resources & Operations
+
+### Incident
+
+| Operation | Description | Endpoint |
+|---|---|---|
+| **Fetch** | Fetch incidents by filters, time range, paging and ordering | `POST /phoenix/rest/pub/incident` |
+| **Get Many** | Retrieve incidents, optionally filtered by status | `GET /phoenix/rest/pub/incident` |
+| **Get Triggering Events** | Retrieve the events that triggered an incident | `GET /phoenix/rest/pub/incident/triggeringEvents` |
+| **Update** | Update the external ticket state of an incident | `POST /phoenix/rest/pub/incident/update/{incidentId}` |
+
+**Fetch** filter options: incident IDs, status, `timeFrom`/`timeTo` (epoch ms), `start`, `size`, `orderBy`, `descending`, and the list of `fields` to return.
+
+---
+
+### Event
+
+| Operation | Description | Endpoint |
+|---|---|---|
+| **Query** | Run an analytic event query defined by an XML report | `POST /phoenix/rest/query/` |
+
+The **Report XML** field is pre-filled with a sample report definition (top events by count) to get you started.
+
+---
+
+### Organization
+
+| Operation | Description | Endpoint |
+|---|---|---|
+| **Get Many** | Retrieve the list of monitored organizations | `GET /phoenix/rest/config/Domain` |
+| **Add** | Add a new organization | `POST /phoenix/rest/organization/add` |
+| **Update** | Update an organization | `GET /phoenix/rest/organization/update` |
+
+---
+
+### Watchlist
+
+| Operation | Description | Endpoint |
+|---|---|---|
+| **Get Many** | Retrieve all watchlists | `GET /phoenix/rest/watchlist/all` |
+| **Get By Entry** | Get the watchlist containing a specific entry | `GET /phoenix/rest/watchlist/byEntry/{id}` |
+| **Add Entry** | Add an entry to a watchlist | `POST /phoenix/rest/watchlist/addTo` |
+| **Create Group** | Create a new watchlist group | `POST /phoenix/rest/watchlist/save` |
+| **Delete Entry** | Delete one or more watchlist entries | `POST /phoenix/rest/watchlist/entry/delete` |
+
+---
+
+## Usage Examples
+
+### Poll for new active incidents and alert
+
+1. Add a **Schedule Trigger**
+2. Add a **FortiSIEM** node → resource **Incident** → **Fetch**, set **Time From**/**Time To** to your window and **Status** to `0` (active)
+3. Add an **IF** node to check severity
+4. Add a **Slack** / **Email** node to notify
+
+### Sync a FortiSIEM incident to an external ticketing system
+
+1. **FortiSIEM** → Incident → **Fetch** the incidents you care about
+2. Create the ticket in your ITSM tool
+3. **FortiSIEM** → Incident → **Update** with the **External Ticket ID** and **External Ticket State** (e.g. `Closed`)
+
+### Investigate an incident's root cause
+
+1. **FortiSIEM** → Incident → **Get Triggering Events**, expression `{{ $json.incidentId }}` as Incident ID
+2. Inspect the raw events that generated the incident
+
+---
+
+## Development
+
+### Requirements
+
+- Node.js ≥ 18
+- npm ≥ 9
+
+### Setup
+
+```bash
+git clone https://github.com/kboykov/n8n-nodes-fortisiem.git
+cd n8n-nodes-fortisiem
+npm install
+```
+
+### Build
+
+```bash
+npm run build
+```
+
+This runs `tsc` followed by `gulp build:icons` to copy the icon into `dist/`.
+
+### Lint & format
+
+```bash
+npm run lint
+npm run lint:fix   # auto-fix where possible
+npm run format     # prettier
+```
+
+### Local testing with n8n
+
+```bash
+# In this repo
+npm link
+
+# In your local n8n installation directory
+npm link n8n-nodes-fortisiem
+```
+
+Then restart n8n. The FortiSIEM node will appear in the node picker.
+
+### Project structure
+
+```
+n8n-nodes-fortisiem/
+├── credentials/
+│   └── FortiSiemApi.credentials.ts     # Credential definition (Basic auth)
+├── nodes/
+│   └── FortiSiem/
+│       ├── FortiSiem.node.ts            # Main node implementation
+│       └── descriptions/
+│           ├── IncidentDescription.ts
+│           ├── EventDescription.ts
+│           ├── OrganizationDescription.ts
+│           └── WatchlistDescription.ts
+├── icons/
+│   └── fortisiem.png
+├── .github/workflows/publish.yml        # Automated npm publish on tag
+├── gulpfile.js
+├── package.json
+└── tsconfig.json
+```
+
+---
+
+## Publishing to npm
+
+Releases are published to [npm](https://www.npmjs.com/package/n8n-nodes-fortisiem) automatically by the [`Publish`](.github/workflows/publish.yml) GitHub Actions workflow, which triggers on any pushed tag matching `*.*.*` (e.g. `0.1.0`).
+
+The workflow runs `npm ci`, then `npm publish --provenance --access public`, so releases include [npm provenance](https://docs.npmjs.com/generating-provenance-statements) attestation.
+
+### One-time setup
+
+1. Create an **automation** access token on npmjs.com (Account → Access Tokens → Generate New Token → *Automation*).
+2. In this repository, go to **Settings → Secrets and variables → Actions** and add a secret named **`NPM_TOKEN`** with that token.
+
+### Cutting a release
+
+```bash
+# Bump the version in package.json and create a matching git tag
+npm version patch   # or: minor / major
+
+# Push the commit and the tag — the tag push triggers the workflow
+git push --follow-tags
+```
+
+Pushing the tag (for example `v0.1.1` → the workflow matches the `0.1.1` portion) starts the workflow, which builds via the `prepublishOnly` script and publishes to npm.
+
+---
+
+## Compatibility
+
+| Component | Status |
+|---|---|
+| n8n Nodes API | v1 |
+| FortiSIEM REST API | `/phoenix/rest` (FortiSIEM ≥ 6.x) |
+
+---
+
+## License
+
+[MIT](LICENSE)
+
+---
+
+## Contributing
+
+Issues and pull requests are welcome. Please open an issue first to discuss any significant changes.

package/dist/credentials/FortiSiemApi.credentials.d.ts

@@ -0,0 +1,10 @@
+import type { IAuthenticateGeneric, ICredentialTestRequest, ICredentialType, INodeProperties } from 'n8n-workflow';
+export declare class FortiSiemApi implements ICredentialType {
+    name: string;
+    displayName: string;
+    documentationUrl: string;
+    properties: INodeProperties[];
+    authenticate: IAuthenticateGeneric;
+    test: ICredentialTestRequest;
+}
+//# sourceMappingURL=FortiSiemApi.credentials.d.ts.map

package/dist/credentials/FortiSiemApi.credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FortiSiemApi.credentials.d.ts","sourceRoot":"","sources":["../../credentials/FortiSiemApi.credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,MAAM,cAAc,CAAC;AAEtB,qBAAa,YAAa,YAAW,eAAe;IACnD,IAAI,SAAkB;IAEtB,WAAW,SAAmB;IAE9B,gBAAgB,SACiG;IAEjH,UAAU,EAAE,eAAe,EAAE,CAsC3B;IAGF,YAAY,EAAE,oBAAoB,CAQhC;IAGF,IAAI,EAAE,sBAAsB,CAO1B;CACF"}

package/dist/credentials/FortiSiemApi.credentials.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FortiSiemApi = void 0;
+class FortiSiemApi {
+    constructor() {
+        this.name = 'fortiSiemApi';
+        this.displayName = 'FortiSIEM API';
+        this.documentationUrl = 'https://docs.fortinet.com/document/fortisiem/6.4.0/integration-api-guide/895612/json-api-incident-integration';
+        this.properties = [
+            {
+                displayName: 'Base URL',
+                name: 'baseUrl',
+                type: 'string',
+                default: '',
+                required: true,
+                placeholder: 'https://your-fortisiem-supervisor',
+                description: 'Base URL of your FortiSIEM Supervisor, including protocol and (optional) port, without a trailing slash',
+            },
+            {
+                displayName: 'Username',
+                name: 'username',
+                type: 'string',
+                default: '',
+                required: true,
+                description: 'FortiSIEM API user in the form <organization>/<user> (for the default organization, e.g. super/admin)',
+            },
+            {
+                displayName: 'Password',
+                name: 'password',
+                type: 'string',
+                typeOptions: {
+                    password: true,
+                },
+                default: '',
+                required: true,
+            },
+            {
+                displayName: 'Ignore SSL Issues (Insecure)',
+                name: 'allowUnauthorizedCerts',
+                type: 'boolean',
+                default: false,
+                description: 'Whether to connect even if SSL certificate validation fails. FortiSIEM appliances often use self-signed certificates.',
+            },
+        ];
+        // FortiSIEM's REST API uses HTTP Basic authentication.
+        this.authenticate = {
+            type: 'generic',
+            properties: {
+                auth: {
+                    username: '={{$credentials.username}}',
+                    password: '={{$credentials.password}}',
+                },
+            },
+        };
+        // Validate the credentials by listing monitored organizations.
+        this.test = {
+            request: {
+                method: 'GET',
+                baseURL: '={{$credentials.baseUrl}}',
+                url: '/phoenix/rest/config/Domain',
+                skipSslCertificateValidation: '={{$credentials.allowUnauthorizedCerts}}',
+            },
+        };
+    }
+}
+exports.FortiSiemApi = FortiSiemApi;
+//# sourceMappingURL=FortiSiemApi.credentials.js.map

package/dist/credentials/FortiSiemApi.credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FortiSiemApi.credentials.js","sourceRoot":"","sources":["../../credentials/FortiSiemApi.credentials.ts"],"names":[],"mappings":";;;AAOA,MAAa,YAAY;IAAzB;QACC,SAAI,GAAG,cAAc,CAAC;QAEtB,gBAAW,GAAG,eAAe,CAAC;QAE9B,qBAAgB,GACf,+GAA+G,CAAC;QAEjH,eAAU,GAAsB;YAC/B;gBACC,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,mCAAmC;gBAChD,WAAW,EACV,yGAAyG;aAC1G;YACD;gBACC,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,IAAI;gBACd,WAAW,EACV,uGAAuG;aACxG;YACD;gBACC,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE;oBACZ,QAAQ,EAAE,IAAI;iBACd;gBACD,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,IAAI;aACd;YACD;gBACC,WAAW,EAAE,8BAA8B;gBAC3C,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,WAAW,EACV,uHAAuH;aACxH;SACD,CAAC;QAEF,uDAAuD;QACvD,iBAAY,GAAyB;YACpC,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACX,IAAI,EAAE;oBACL,QAAQ,EAAE,4BAA4B;oBACtC,QAAQ,EAAE,4BAA4B;iBACtC;aACD;SACD,CAAC;QAEF,+DAA+D;QAC/D,SAAI,GAA2B;YAC9B,OAAO,EAAE;gBACR,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,2BAA2B;gBACpC,GAAG,EAAE,6BAA6B;gBAClC,4BAA4B,EAAE,0CAA0C;aACxE;SACD,CAAC;IACH,CAAC;CAAA;AApED,oCAoEC"}

package/dist/nodes/FortiSiem/FortiSiem.node.d.ts

@@ -0,0 +1,6 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeType, INodeTypeDescription } from 'n8n-workflow';
+export declare class FortiSiem implements INodeType {
+    description: INodeTypeDescription;
+    execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]>;
+}
+//# sourceMappingURL=FortiSiem.node.d.ts.map

package/dist/nodes/FortiSiem/FortiSiem.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FortiSiem.node.d.ts","sourceRoot":"","sources":["../../../nodes/FortiSiem/FortiSiem.node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEX,iBAAiB,EAGjB,kBAAkB,EAClB,SAAS,EACT,oBAAoB,EACpB,MAAM,cAAc,CAAC;AA6CtB,qBAAa,SAAU,YAAW,SAAS;IAC1C,WAAW,EAAE,oBAAoB,CAgE/B;IAEI,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;CAuNvE"}

package/dist/nodes/FortiSiem/FortiSiem.node.js

@@ -0,0 +1,284 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FortiSiem = void 0;
+const n8n_workflow_1 = require("n8n-workflow");
+const EventDescription_1 = require("./descriptions/EventDescription");
+const IncidentDescription_1 = require("./descriptions/IncidentDescription");
+const OrganizationDescription_1 = require("./descriptions/OrganizationDescription");
+const WatchlistDescription_1 = require("./descriptions/WatchlistDescription");
+// FortiSIEM returns most payloads as text/plain even though the body is JSON,
+// so parse it ourselves and fall back to the raw string when it isn't JSON.
+function parseResponse(response) {
+    if (typeof response !== 'string') {
+        return response;
+    }
+    const trimmed = response.trim();
+    if (trimmed === '') {
+        return { success: true };
+    }
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return { data: response };
+    }
+}
+// Split a comma-separated string into a trimmed, non-empty list.
+function splitList(value) {
+    return value
+        .split(',')
+        .map((part) => part.trim())
+        .filter((part) => part !== '');
+}
+class FortiSiem {
+    constructor() {
+        this.description = {
+            displayName: 'FortiSIEM',
+            name: 'fortiSiem',
+            icon: 'file:../../icons/fortisiem.png',
+            // 'input' is correct for nodes that fetch / mutate data in an external system
+            group: ['input'],
+            version: 1,
+            subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
+            description: 'Interact with the FortiSIEM security information and event management platform',
+            defaults: {
+                name: 'FortiSIEM',
+            },
+            usableAsTool: true,
+            inputs: ['main'],
+            outputs: ['main'],
+            credentials: [
+                {
+                    name: 'fortiSiemApi',
+                    required: true,
+                },
+            ],
+            properties: [
+                {
+                    displayName: 'Resource',
+                    name: 'resource',
+                    type: 'options',
+                    noDataExpression: true,
+                    options: [
+                        {
+                            name: 'Event',
+                            value: 'event',
+                            description: 'Run analytic queries against collected events',
+                        },
+                        {
+                            name: 'Incident',
+                            value: 'incident',
+                            description: 'Fetch, inspect and update incidents',
+                        },
+                        {
+                            name: 'Organization',
+                            value: 'organization',
+                            description: 'Manage monitored organizations',
+                        },
+                        {
+                            name: 'Watchlist',
+                            value: 'watchlist',
+                            description: 'Manage watchlists and their entries',
+                        },
+                    ],
+                    default: 'incident',
+                },
+                // ── Operations (one block per resource) ─────────────────────
+                ...EventDescription_1.eventOperations,
+                ...IncidentDescription_1.incidentOperations,
+                ...OrganizationDescription_1.organizationOperations,
+                ...WatchlistDescription_1.watchlistOperations,
+                // ── Fields (one block per resource) ─────────────────────────
+                ...EventDescription_1.eventFields,
+                ...IncidentDescription_1.incidentFields,
+                ...OrganizationDescription_1.organizationFields,
+                ...WatchlistDescription_1.watchlistFields,
+            ],
+        };
+    }
+    async execute() {
+        const items = this.getInputData();
+        const returnData = [];
+        const credentials = (await this.getCredentials('fortiSiemApi'));
+        const baseUrl = credentials.baseUrl.replace(/\/$/, '');
+        // Typed helper — authentication (Basic auth) is injected via the credential.
+        const makeRequest = async (method, path, options = {}) => {
+            var _a;
+            const requestOptions = {
+                method,
+                url: `${baseUrl}${path}`,
+                headers: {
+                    Accept: 'application/json',
+                    ...(options.contentType ? { 'Content-Type': options.contentType } : {}),
+                },
+                qs: options.qs && Object.keys(options.qs).length ? options.qs : undefined,
+                body: options.body,
+                json: (_a = options.json) !== null && _a !== void 0 ? _a : false,
+                skipSslCertificateValidation: credentials.allowUnauthorizedCerts,
+            };
+            return this.helpers.httpRequestWithAuthentication.call(this, 'fortiSiemApi', requestOptions);
+        };
+        for (let i = 0; i < items.length; i++) {
+            try {
+                const resource = this.getNodeParameter('resource', i);
+                const operation = this.getNodeParameter('operation', i);
+                let responseData;
+                // ── INCIDENT ─────────────────────────────────────────────
+                if (resource === 'incident') {
+                    if (operation === 'getMany') {
+                        const status = this.getNodeParameter('status', i, '');
+                        const qs = {};
+                        if (status !== '')
+                            qs.status = status;
+                        responseData = parseResponse(await makeRequest('GET', '/phoenix/rest/pub/incident', { qs }));
+                    }
+                    else if (operation === 'fetch') {
+                        const filters = this.getNodeParameter('filterOptions', i, {});
+                        const body = {};
+                        const filterClause = {};
+                        if (filters.incidentId) {
+                            filterClause.incidentId = splitList(filters.incidentId).map(Number);
+                        }
+                        if (filters.status) {
+                            filterClause.status = splitList(filters.status).map(Number);
+                        }
+                        if (Object.keys(filterClause).length)
+                            body.filters = filterClause;
+                        if (filters.timeFrom)
+                            body.timeFrom = filters.timeFrom;
+                        if (filters.timeTo)
+                            body.timeTo = filters.timeTo;
+                        if (filters.start !== undefined)
+                            body.start = filters.start;
+                        if (filters.size !== undefined)
+                            body.size = filters.size;
+                        if (filters.orderBy)
+                            body.orderBy = filters.orderBy;
+                        if (filters.descending !== undefined)
+                            body.descending = filters.descending;
+                        if (filters.fields)
+                            body.fields = splitList(filters.fields);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/pub/incident', {
+                            body,
+                            contentType: 'application/json',
+                            json: true,
+                        }));
+                    }
+                    else if (operation === 'getTriggeringEvents') {
+                        const incidentId = this.getNodeParameter('incidentId', i);
+                        const size = this.getNodeParameter('size', i);
+                        responseData = parseResponse(await makeRequest('GET', '/phoenix/rest/pub/incident/triggeringEvents', {
+                            qs: { incidentId, size },
+                        }));
+                    }
+                    else if (operation === 'update') {
+                        const incidentId = this.getNodeParameter('incidentId', i);
+                        const incidentExtTicketId = this.getNodeParameter('incidentExtTicketId', i);
+                        const updateFields = this.getNodeParameter('updateFields', i, {});
+                        const body = { incidentExtTicketId, ...updateFields };
+                        responseData = parseResponse(await makeRequest('POST', `/phoenix/rest/pub/incident/update/${encodeURIComponent(incidentId)}`, { body, contentType: 'application/json', json: true }));
+                    }
+                    else {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Unknown operation: ${operation}`, {
+                            itemIndex: i,
+                        });
+                    }
+                    // ── EVENT ────────────────────────────────────────────────
+                }
+                else if (resource === 'event') {
+                    if (operation === 'query') {
+                        const reportXml = this.getNodeParameter('reportXml', i);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/query/', {
+                            body: reportXml,
+                            contentType: 'text/xml',
+                        }));
+                    }
+                    else {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Unknown operation: ${operation}`, {
+                            itemIndex: i,
+                        });
+                    }
+                    // ── ORGANIZATION ─────────────────────────────────────────
+                }
+                else if (resource === 'organization') {
+                    if (operation === 'getMany') {
+                        responseData = parseResponse(await makeRequest('GET', '/phoenix/rest/config/Domain'));
+                    }
+                    else if (operation === 'add') {
+                        const body = this.getNodeParameter('body', i);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/organization/add', {
+                            body,
+                            contentType: 'text/xml',
+                        }));
+                    }
+                    else if (operation === 'update') {
+                        responseData = parseResponse(await makeRequest('GET', '/phoenix/rest/organization/update'));
+                    }
+                    else {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Unknown operation: ${operation}`, {
+                            itemIndex: i,
+                        });
+                    }
+                    // ── WATCHLIST ────────────────────────────────────────────
+                }
+                else if (resource === 'watchlist') {
+                    if (operation === 'getMany') {
+                        responseData = parseResponse(await makeRequest('GET', '/phoenix/rest/watchlist/all'));
+                    }
+                    else if (operation === 'getByEntry') {
+                        const entryId = this.getNodeParameter('entryId', i);
+                        responseData = parseResponse(await makeRequest('GET', `/phoenix/rest/watchlist/byEntry/${encodeURIComponent(entryId)}`));
+                    }
+                    else if (operation === 'addEntry') {
+                        const watchlistId = this.getNodeParameter('watchlistId', i);
+                        const body = this.getNodeParameter('body', i);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/watchlist/addTo', {
+                            body,
+                            qs: { watchlistId },
+                            contentType: 'application/json',
+                        }));
+                    }
+                    else if (operation === 'createGroup') {
+                        const body = this.getNodeParameter('body', i);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/watchlist/save', {
+                            body,
+                            contentType: 'application/json',
+                        }));
+                    }
+                    else if (operation === 'deleteEntry') {
+                        const body = this.getNodeParameter('body', i);
+                        responseData = parseResponse(await makeRequest('POST', '/phoenix/rest/watchlist/entry/delete', {
+                            body,
+                            contentType: 'application/json',
+                        }));
+                    }
+                    else {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Unknown operation: ${operation}`, {
+                            itemIndex: i,
+                        });
+                    }
+                }
+                else {
+                    throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Unknown resource: ${resource}`, {
+                        itemIndex: i,
+                    });
+                }
+                const executionData = this.helpers.constructExecutionMetaData(this.helpers.returnJsonArray(responseData), { itemData: { item: i } });
+                returnData.push(...executionData);
+            }
+            catch (error) {
+                if (this.continueOnFail()) {
+                    returnData.push({
+                        json: { error: error.message },
+                        pairedItem: { item: i },
+                    });
+                    continue;
+                }
+                throw error;
+            }
+        }
+        return [returnData];
+    }
+}
+exports.FortiSiem = FortiSiem;
+//# sourceMappingURL=FortiSiem.node.js.map