f5audit 0.1.0__tar.gz

f5audit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Israel Fernandez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

f5audit-0.1.0/MANIFEST.in

@@ -0,0 +1,2 @@
+# Ship a complete, runnable test suite in the sdist (fixtures included).
+recursive-include tests *.py *.json

f5audit-0.1.0/PKG-INFO

@@ -0,0 +1,184 @@
+Metadata-Version: 2.4
+Name: f5audit
+Version: 0.1.0
+Summary: Read-only audit tool for F5 BIG-IP LTM: finds unused nodes, pools, virtual servers and monitors via iControl REST and produces an Excel report.
+Author-email: Israel Fernandez <israelfdzhdz@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/netcraftworks/f5audit
+Project-URL: Repository, https://github.com/netcraftworks/f5audit
+Project-URL: Issues, https://github.com/netcraftworks/f5audit/issues
+Keywords: f5,big-ip,ltm,audit,icontrol-rest,network-automation
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.25
+Requires-Dist: openpyxl>=3.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Dynamic: license-file
+
+# f5audit
+
+[![CI](https://github.com/netcraftworks/f5audit/actions/workflows/ci.yml/badge.svg)](https://github.com/netcraftworks/f5audit/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/f5audit)](https://pypi.org/project/f5audit/)
+[![Python](https://img.shields.io/pypi/pyversions/f5audit)](https://pypi.org/project/f5audit/)
+
+Read-only audit tool for **F5 BIG-IP LTM**. It collects configuration and
+statistics via iControl REST (GET only), correlates object references, and
+produces a multi-sheet **Excel report** identifying unused objects (nodes,
+pools, virtual servers, monitors) as input for a human-driven, change-
+controlled cleanup.
+
+**This tool never modifies the device.** The "suggested command" columns in
+the report are informational text only; nothing is ever executed.
+
+## Safety design
+
+- The HTTP client (`F5ReadOnlyClient`) exposes a single `get()` method.
+  There are no `post`/`patch`/`put`/`delete` methods. The only internal
+  write is the token login, hardcoded to `/mgmt/shared/authn/login`.
+  This is enforced by structural tests.
+- No `tmsh`/bash execution endpoints are used or referenced anywhere.
+- No explicit logout (deleting the token would be a write); tokens expire
+  on their own (~20 minutes).
+- Passwords are read from an interactive prompt (`getpass`) or the
+  `F5_PASS` environment variable — never from a CLI argument, and never
+  written to disk or logs.
+- Management-plane friendly: sequential requests only, `$top`/`$skip`
+  pagination, per-request delay (`--delay`, default 0.1 s), 30 s timeout,
+  max 2 retries with exponential backoff.
+
+## Requirements
+
+- Python >= 3.9, `requests`, `openpyxl`
+- An account with a **read-only role** (Auditor/Guest) and iControl REST
+  access on the BIG-IP
+- Network access to the management interface (TCP 443)
+
+## Installation
+
+```
+pip install f5audit
+```
+
+From source: `pip install .` — or without installing, from the project
+directory: `python -m f5audit ...`
+
+## Usage
+
+### 1. Validate access first
+
+```
+f5audit validate --host 192.0.2.1 --user auditor --insecure
+```
+
+Probes login plus the key GET endpoints and prints a diagnosis per
+response code (bad credentials, missing REST access, denied endpoints,
+old BIG-IP versions, network timeouts).
+
+### 2. Collect once, analyze offline N times
+
+```
+f5audit collect --host 192.0.2.1 --user auditor --insecure --save-raw ./raw/
+f5audit analyze --from-raw ./raw/ --out report.xlsx
+```
+
+`collect` saves every raw JSON response (with timestamps) to disk;
+`analyze --from-raw` re-analyzes from that cache **without touching the
+F5 again**. This is the recommended workflow: one collection per session,
+all further analysis offline.
+
+### One-step alternative
+
+```
+f5audit analyze --host 192.0.2.1 --user auditor --insecure --save-raw ./raw/ --out report.xlsx
+```
+
+### Options
+
+| Flag | Meaning |
+|---|---|
+| `--user` / `F5_USER` | Username (password via prompt or `F5_PASS`) |
+| `--login-provider` | Token auth provider (default `tmos`; set for TACACS+/RADIUS) |
+| `--insecure` | Skip TLS verification (self-signed mgmt certs); prints a warning |
+| `--delay` | Seconds between requests (default 0.1) |
+| `--top` | Pagination page size (default 100) |
+| `--format xlsx\|csv` | Excel workbook or one CSV per sheet |
+| `--allow-standby` | On a standby unit, emit traffic verdicts marked `UNRELIABLE (standby)` instead of skipping them |
+
+Exit codes: `0` OK · `1` connection/auth error · `2` analysis completed
+with warnings (standby device, denied partitions, missing endpoints).
+
+## Verdicts
+
+| Verdict | Meaning |
+|---|---|
+| `ORPHAN` | Not referenced by anything (node: no pool membership; pool: no VS/iRule/policy reference; monitor: no user). Only issued when the inventory is complete and no dynamic iRules are active. |
+| `MANUAL REVIEW` | A dynamic iRule (`pool $var`, `pool [...]`, datagroups) or a missing `ltm/rule` endpoint means the object *could* be referenced at runtime. Never auto-cleanup these. |
+| `INACTIVE` | Configured and referenced, but disabled or zero total connections since the last counter reset. |
+| `UNRELIABLE (standby)` | Traffic-based verdict computed on a standby unit (only with `--allow-standby`). |
+| `UNRELIABLE (incomplete inventory)` | Some partitions were not readable; a reference could exist in an invisible partition. |
+| `IN USE` | Everything else. |
+
+## Operational warning
+
+- **Collect on the ACTIVE unit** of the HA pair. On a standby unit traffic
+  counters are zeros and the tool will skip traffic analysis (or mark it
+  `UNRELIABLE` with `--allow-standby`).
+- Traffic counters reset on reboot / stats reset. Ideally collect after
+  **several weeks of uptime**; the report includes the failover-state age
+  as context.
+- `INACTIVE` means "no traffic since the counters started", not "safe to
+  delete". Use the planned `compare` workflow (v2) — two collections some
+  weeks apart — to distinguish real zero traffic from a recent reset.
+  The raw cache already stores per-file timestamps to enable this.
+
+## Report sheets
+
+1. **Summary** — hostname, version, HA state, uptime context, partitions,
+   verdict counts, active warnings.
+2. **Inventory** — one row per pool member (plus rows for pool-less
+   nodes), fully correlated: node ↔ pool ↔ virtual server ↔ monitor ↔
+   iRule/policy references, statuses, traffic and verdict.
+3. **Orphan Nodes** · 4. **Orphan-Inactive Pools** · 5. **Inactive
+   Virtual Servers** · 6. **Orphan Monitors** — filtered views with
+   informational `tmsh` commands for the change request.
+7. **Manual Review** — objects touched by dynamic logic, with the
+   iRule/policy that causes the doubt.
+
+Color coding: red = ORPHAN · yellow = MANUAL REVIEW / UNRELIABLE ·
+orange = INACTIVE · green = IN USE.
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check f5audit tests && ruff format --check f5audit tests
+pytest
+```
+
+No test touches the network; everything runs from anonymized JSON
+fixtures and mocked HTTP sessions. Structural tests assert the client
+exposes no write verbs and that no forbidden endpoint appears in the
+source. CI runs lint plus the test suite on Python 3.9 through 3.14;
+all checks must pass before a PR can merge.
+
+Releases are published to PyPI automatically: bump `__version__` in
+`f5audit/__init__.py`, merge, and create a GitHub release tagged
+`v<version>`. The release workflow verifies the tag matches the package
+version, builds, and publishes via PyPI Trusted Publishing (no stored
+API tokens).

f5audit-0.1.0/README.md

@@ -0,0 +1,151 @@
+# f5audit
+
+[![CI](https://github.com/netcraftworks/f5audit/actions/workflows/ci.yml/badge.svg)](https://github.com/netcraftworks/f5audit/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/f5audit)](https://pypi.org/project/f5audit/)
+[![Python](https://img.shields.io/pypi/pyversions/f5audit)](https://pypi.org/project/f5audit/)
+
+Read-only audit tool for **F5 BIG-IP LTM**. It collects configuration and
+statistics via iControl REST (GET only), correlates object references, and
+produces a multi-sheet **Excel report** identifying unused objects (nodes,
+pools, virtual servers, monitors) as input for a human-driven, change-
+controlled cleanup.
+
+**This tool never modifies the device.** The "suggested command" columns in
+the report are informational text only; nothing is ever executed.
+
+## Safety design
+
+- The HTTP client (`F5ReadOnlyClient`) exposes a single `get()` method.
+  There are no `post`/`patch`/`put`/`delete` methods. The only internal
+  write is the token login, hardcoded to `/mgmt/shared/authn/login`.
+  This is enforced by structural tests.
+- No `tmsh`/bash execution endpoints are used or referenced anywhere.
+- No explicit logout (deleting the token would be a write); tokens expire
+  on their own (~20 minutes).
+- Passwords are read from an interactive prompt (`getpass`) or the
+  `F5_PASS` environment variable — never from a CLI argument, and never
+  written to disk or logs.
+- Management-plane friendly: sequential requests only, `$top`/`$skip`
+  pagination, per-request delay (`--delay`, default 0.1 s), 30 s timeout,
+  max 2 retries with exponential backoff.
+
+## Requirements
+
+- Python >= 3.9, `requests`, `openpyxl`
+- An account with a **read-only role** (Auditor/Guest) and iControl REST
+  access on the BIG-IP
+- Network access to the management interface (TCP 443)
+
+## Installation
+
+```
+pip install f5audit
+```
+
+From source: `pip install .` — or without installing, from the project
+directory: `python -m f5audit ...`
+
+## Usage
+
+### 1. Validate access first
+
+```
+f5audit validate --host 192.0.2.1 --user auditor --insecure
+```
+
+Probes login plus the key GET endpoints and prints a diagnosis per
+response code (bad credentials, missing REST access, denied endpoints,
+old BIG-IP versions, network timeouts).
+
+### 2. Collect once, analyze offline N times
+
+```
+f5audit collect --host 192.0.2.1 --user auditor --insecure --save-raw ./raw/
+f5audit analyze --from-raw ./raw/ --out report.xlsx
+```
+
+`collect` saves every raw JSON response (with timestamps) to disk;
+`analyze --from-raw` re-analyzes from that cache **without touching the
+F5 again**. This is the recommended workflow: one collection per session,
+all further analysis offline.
+
+### One-step alternative
+
+```
+f5audit analyze --host 192.0.2.1 --user auditor --insecure --save-raw ./raw/ --out report.xlsx
+```
+
+### Options
+
+| Flag | Meaning |
+|---|---|
+| `--user` / `F5_USER` | Username (password via prompt or `F5_PASS`) |
+| `--login-provider` | Token auth provider (default `tmos`; set for TACACS+/RADIUS) |
+| `--insecure` | Skip TLS verification (self-signed mgmt certs); prints a warning |
+| `--delay` | Seconds between requests (default 0.1) |
+| `--top` | Pagination page size (default 100) |
+| `--format xlsx\|csv` | Excel workbook or one CSV per sheet |
+| `--allow-standby` | On a standby unit, emit traffic verdicts marked `UNRELIABLE (standby)` instead of skipping them |
+
+Exit codes: `0` OK · `1` connection/auth error · `2` analysis completed
+with warnings (standby device, denied partitions, missing endpoints).
+
+## Verdicts
+
+| Verdict | Meaning |
+|---|---|
+| `ORPHAN` | Not referenced by anything (node: no pool membership; pool: no VS/iRule/policy reference; monitor: no user). Only issued when the inventory is complete and no dynamic iRules are active. |
+| `MANUAL REVIEW` | A dynamic iRule (`pool $var`, `pool [...]`, datagroups) or a missing `ltm/rule` endpoint means the object *could* be referenced at runtime. Never auto-cleanup these. |
+| `INACTIVE` | Configured and referenced, but disabled or zero total connections since the last counter reset. |
+| `UNRELIABLE (standby)` | Traffic-based verdict computed on a standby unit (only with `--allow-standby`). |
+| `UNRELIABLE (incomplete inventory)` | Some partitions were not readable; a reference could exist in an invisible partition. |
+| `IN USE` | Everything else. |
+
+## Operational warning
+
+- **Collect on the ACTIVE unit** of the HA pair. On a standby unit traffic
+  counters are zeros and the tool will skip traffic analysis (or mark it
+  `UNRELIABLE` with `--allow-standby`).
+- Traffic counters reset on reboot / stats reset. Ideally collect after
+  **several weeks of uptime**; the report includes the failover-state age
+  as context.
+- `INACTIVE` means "no traffic since the counters started", not "safe to
+  delete". Use the planned `compare` workflow (v2) — two collections some
+  weeks apart — to distinguish real zero traffic from a recent reset.
+  The raw cache already stores per-file timestamps to enable this.
+
+## Report sheets
+
+1. **Summary** — hostname, version, HA state, uptime context, partitions,
+   verdict counts, active warnings.
+2. **Inventory** — one row per pool member (plus rows for pool-less
+   nodes), fully correlated: node ↔ pool ↔ virtual server ↔ monitor ↔
+   iRule/policy references, statuses, traffic and verdict.
+3. **Orphan Nodes** · 4. **Orphan-Inactive Pools** · 5. **Inactive
+   Virtual Servers** · 6. **Orphan Monitors** — filtered views with
+   informational `tmsh` commands for the change request.
+7. **Manual Review** — objects touched by dynamic logic, with the
+   iRule/policy that causes the doubt.
+
+Color coding: red = ORPHAN · yellow = MANUAL REVIEW / UNRELIABLE ·
+orange = INACTIVE · green = IN USE.
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check f5audit tests && ruff format --check f5audit tests
+pytest
+```
+
+No test touches the network; everything runs from anonymized JSON
+fixtures and mocked HTTP sessions. Structural tests assert the client
+exposes no write verbs and that no forbidden endpoint appears in the
+source. CI runs lint plus the test suite on Python 3.9 through 3.14;
+all checks must pass before a PR can merge.
+
+Releases are published to PyPI automatically: bump `__version__` in
+`f5audit/__init__.py`, merge, and create a GitHub release tagged
+`v<version>`. The release workflow verifies the tag matches the package
+version, builds, and publishes via PyPI Trusted Publishing (no stored
+API tokens).

f5audit-0.1.0/f5audit/__init__.py

@@ -0,0 +1,8 @@
+"""f5audit: read-only audit tool for F5 BIG-IP LTM configurations.
+
+Collects configuration and statistics via iControl REST (GET only),
+correlates object references, and reports orphaned / inactive objects
+as input for a human-driven, change-controlled cleanup.
+"""
+
+__version__ = "0.1.0"

f5audit-0.1.0/f5audit/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

f5audit-0.1.0/f5audit/analyzer.py

@@ -0,0 +1,301 @@
+"""Verdict rules.
+
+Cross-cutting rules (spec section 8):
+- No object touched by dynamic pool-selection logic can ever be ORPHAN;
+  the ceiling is MANUAL REVIEW.
+- Traffic-based verdicts are only trusted when the device is ACTIVE;
+  on a standby unit they are either skipped (default) or emitted as
+  UNRELIABLE (standby) with --allow-standby.
+- Incomplete inventory (denied partitions/endpoints) degrades orphan
+  verdicts, because a reference could live in an invisible partition.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from .correlator import Correlation, is_builtin_monitor
+from .parsing import ParsedData
+
+
+class Verdict:
+    ORPHAN = "ORPHAN"
+    MANUAL_REVIEW = "MANUAL REVIEW"
+    INACTIVE = "INACTIVE"
+    UNRELIABLE_STANDBY = "UNRELIABLE (standby)"
+    UNRELIABLE_INVENTORY = "UNRELIABLE (incomplete inventory)"
+    IN_USE = "IN USE"
+
+
+@dataclass
+class ObjectVerdict:
+    verdict: str
+    notes: str = ""
+
+
+@dataclass
+class ManualReviewItem:
+    object_type: str
+    full_path: str
+    reason: str
+    caused_by: str = ""
+
+
+@dataclass
+class AnalysisResult:
+    node_verdicts: dict[str, ObjectVerdict] = field(default_factory=dict)
+    pool_verdicts: dict[str, ObjectVerdict] = field(default_factory=dict)
+    virtual_verdicts: dict[str, ObjectVerdict] = field(default_factory=dict)
+    monitor_verdicts: dict[str, ObjectVerdict] = field(default_factory=dict)
+    manual_review: list[ManualReviewItem] = field(default_factory=list)
+    warnings: list[str] = field(default_factory=list)
+    stats_analysis_skipped: bool = False
+
+    def verdict_counts(self) -> dict[str, int]:
+        counts: dict[str, int] = {}
+        for verdicts in (
+            self.node_verdicts,
+            self.pool_verdicts,
+            self.virtual_verdicts,
+            self.monitor_verdicts,
+        ):
+            for object_verdict in verdicts.values():
+                counts[object_verdict.verdict] = counts.get(object_verdict.verdict, 0) + 1
+        return counts
+
+
+def _conns_zero(total_conns: int | None) -> bool:
+    return total_conns is not None and int(total_conns) == 0
+
+
+class Analyzer:
+    def __init__(
+        self, parsed: ParsedData, correlation: Correlation, *, allow_standby: bool = False
+    ):
+        self.parsed = parsed
+        self.correlation = correlation
+        self.allow_standby = allow_standby
+
+        system = parsed.system
+        self.is_standby = system.failover_state == "standby"
+        self.inventory_complete = not system.partitions_denied and not any(
+            "/ltm/node" in ep or "/ltm/pool" in ep or "/ltm/virtual" in ep
+            for ep in system.missing_endpoints
+        )
+        self.irules_available = not any("/ltm/rule" in ep for ep in system.missing_endpoints)
+        # Uptime context: traffic counters reset on reboot / stats reset.
+        self.traffic_note = (
+            "Traffic counters reset on reboot/stats-reset; "
+            f"{system.uptime or 'device uptime unknown'}."
+        )
+
+    # ------------------------------------------------------------------
+
+    def run(self) -> AnalysisResult:
+        result = AnalysisResult()
+        self._collect_warnings(result)
+        self._analyze_nodes(result)
+        self._analyze_virtuals(result)
+        self._analyze_pools(result)
+        self._analyze_monitors(result)
+        self._analyze_irules(result)
+        return result
+
+    def _collect_warnings(self, result: AnalysisResult) -> None:
+        system = self.parsed.system
+        if self.is_standby:
+            if self.allow_standby:
+                result.warnings.append(
+                    "Device is STANDBY: traffic statistics are not "
+                    "representative. Traffic-based verdicts are marked "
+                    "UNRELIABLE (standby). Re-run against the ACTIVE unit."
+                )
+            else:
+                result.stats_analysis_skipped = True
+                result.warnings.append(
+                    "Device is STANDBY: traffic-based analysis was SKIPPED "
+                    "(configuration-orphan analysis still ran). Re-run "
+                    "against the ACTIVE unit, or use --allow-standby to "
+                    "force traffic verdicts marked as UNRELIABLE."
+                )
+        if system.partitions_denied:
+            result.warnings.append(
+                "Access denied to partition(s): "
+                + ", ".join(system.partitions_denied)
+                + ". Orphan verdicts are degraded to UNRELIABLE (incomplete "
+                "inventory) because objects could be referenced from an "
+                "invisible partition."
+            )
+        if not self.irules_available:
+            result.warnings.append(
+                "ltm/rule was not readable: pool orphan verdicts are capped "
+                "at MANUAL REVIEW (an iRule could reference them)."
+            )
+        for endpoint in system.missing_endpoints:
+            if "/ltm/rule" not in endpoint:
+                result.warnings.append(f"Endpoint not collected: {endpoint}")
+
+    # ------------------------------------------------------------------
+
+    def _analyze_nodes(self, result: AnalysisResult) -> None:
+        for path, _node in self.parsed.nodes.items():
+            pools = self.correlation.node_to_pools.get(path)
+            if pools:
+                result.node_verdicts[path] = ObjectVerdict(Verdict.IN_USE)
+            elif not self.inventory_complete:
+                result.node_verdicts[path] = ObjectVerdict(
+                    Verdict.UNRELIABLE_INVENTORY,
+                    "Not a member of any visible pool, but some partitions were not readable.",
+                )
+            else:
+                result.node_verdicts[path] = ObjectVerdict(
+                    Verdict.ORPHAN, "Not a member of any pool."
+                )
+
+    def _analyze_virtuals(self, result: AnalysisResult) -> None:
+        for path, virtual in self.parsed.virtuals.items():
+            if virtual.admin_state == "disabled":
+                result.virtual_verdicts[path] = ObjectVerdict(
+                    Verdict.INACTIVE, "Administratively disabled."
+                )
+                continue
+            if not virtual.default_pool and (virtual.irules or virtual.policies):
+                result.virtual_verdicts[path] = ObjectVerdict(
+                    Verdict.MANUAL_REVIEW,
+                    "No default pool; traffic is steered by iRules/policies.",
+                )
+                result.manual_review.append(
+                    ManualReviewItem(
+                        "virtual_server",
+                        path,
+                        "No default pool but has iRules/policies attached",
+                        ", ".join(virtual.irules + virtual.policies),
+                    )
+                )
+                continue
+            if _conns_zero(virtual.total_conns):
+                self._traffic_verdict(
+                    result.virtual_verdicts,
+                    path,
+                    "Enabled but zero total connections. " + self.traffic_note,
+                )
+                continue
+            result.virtual_verdicts[path] = ObjectVerdict(Verdict.IN_USE)
+
+    def _traffic_verdict(self, verdicts: dict[str, ObjectVerdict], path: str, note: str) -> None:
+        """Emit a traffic-based INACTIVE verdict, degraded on standby."""
+        if self.is_standby:
+            if self.allow_standby:
+                verdicts[path] = ObjectVerdict(
+                    Verdict.UNRELIABLE_STANDBY,
+                    "Zero traffic, but this device is standby. " + note,
+                )
+            else:
+                verdicts[path] = ObjectVerdict(
+                    Verdict.IN_USE,
+                    "Traffic analysis skipped (standby device).",
+                )
+        else:
+            verdicts[path] = ObjectVerdict(Verdict.INACTIVE, note)
+
+    def _analyze_pools(self, result: AnalysisResult) -> None:
+        for path, _pool in self.parsed.pools.items():
+            virtuals = self.correlation.pool_to_virtuals.get(path, set())
+            irule_refs = self.correlation.pool_to_irules.get(path, set())
+            policy_refs = self.correlation.pool_to_policies.get(path, set())
+
+            if not virtuals and not irule_refs and not policy_refs:
+                self._unreferenced_pool_verdict(result, path)
+                continue
+
+            # Referenced pool: inactive if every attached VS has zero traffic.
+            if (
+                virtuals
+                and all(
+                    _conns_zero(self.parsed.virtuals[v].total_conns)
+                    for v in virtuals
+                    if v in self.parsed.virtuals
+                )
+                and any(v in self.parsed.virtuals for v in virtuals)
+            ):
+                self._traffic_verdict(
+                    result.pool_verdicts,
+                    path,
+                    "All attached virtual servers have zero total "
+                    "connections. " + self.traffic_note,
+                )
+                continue
+            result.pool_verdicts[path] = ObjectVerdict(Verdict.IN_USE)
+
+    def _unreferenced_pool_verdict(self, result: AnalysisResult, path: str) -> None:
+        if not self.inventory_complete:
+            result.pool_verdicts[path] = ObjectVerdict(
+                Verdict.UNRELIABLE_INVENTORY,
+                "No visible references, but some partitions were not readable.",
+            )
+        elif not self.irules_available:
+            result.pool_verdicts[path] = ObjectVerdict(
+                Verdict.MANUAL_REVIEW,
+                "No VS/policy references; iRules could not be read "
+                "(ltm/rule denied), so an iRule reference cannot be ruled out.",
+            )
+            result.manual_review.append(
+                ManualReviewItem(
+                    "pool",
+                    path,
+                    "Unreferenced, but ltm/rule was not readable",
+                )
+            )
+        elif self.correlation.has_attached_dynamic_irules:
+            dynamic = ", ".join(self.correlation.attached_dynamic_irules)
+            result.pool_verdicts[path] = ObjectVerdict(
+                Verdict.MANUAL_REVIEW,
+                "No static references, but dynamic pool-selection iRules "
+                f"are active ({dynamic}); the pool could be selected at "
+                "runtime.",
+            )
+            result.manual_review.append(
+                ManualReviewItem(
+                    "pool",
+                    path,
+                    "No static references but dynamic iRules are active",
+                    dynamic,
+                )
+            )
+        else:
+            result.pool_verdicts[path] = ObjectVerdict(
+                Verdict.ORPHAN,
+                "Not referenced by any virtual server, iRule or policy.",
+            )
+
+    def _analyze_monitors(self, result: AnalysisResult) -> None:
+        for path, _monitor in self.parsed.monitors.items():
+            if is_builtin_monitor(path):
+                result.monitor_verdicts[path] = ObjectVerdict(
+                    Verdict.IN_USE, "F5 built-in monitor (excluded from orphan analysis)."
+                )
+                continue
+            users = self.correlation.monitor_users.get(path)
+            if users:
+                result.monitor_verdicts[path] = ObjectVerdict(Verdict.IN_USE)
+            elif not self.inventory_complete:
+                result.monitor_verdicts[path] = ObjectVerdict(
+                    Verdict.UNRELIABLE_INVENTORY,
+                    "Unused in visible partitions, but some partitions were not readable.",
+                )
+            else:
+                result.monitor_verdicts[path] = ObjectVerdict(
+                    Verdict.ORPHAN, "Not used by any node or pool."
+                )
+
+    def _analyze_irules(self, result: AnalysisResult) -> None:
+        for path, irule in self.parsed.irules.items():
+            if irule.has_dynamic_pool_selection:
+                result.manual_review.append(
+                    ManualReviewItem(
+                        "irule",
+                        path,
+                        "Selects pools dynamically ($variable, [command] or "
+                        "datagroup); static analysis cannot resolve its targets",
+                    )
+                )