Mythal
real poc · 360°
CSX Proof of Concept · the complete picture

The real demo, end to end, 360°.

Everything in one place: what we're proving, every container and what it runs, exactly which parts are real versus standing in, the precise vulnerabilities involved, what happens the moment you press the button, and what to expect when it runs. No hand-waving — this is the deployed system, verified all-green.

Containers live
15
4 Mythal · 11 lab
Vulnerable hosts
7
Ubuntu · Debian · Rocky
Real CVEs
9
5 KEV · 3 CVSS≥9.8
Scanner
Real
Patcher
Ansible
Verified result
7/7 closed
What we're trying to do

Prove the loop on real software, in our environment

The goal

CVE → verified fix, autonomously

A real scanner finds a real vulnerability in real platform software; Mythal's twelve agents enrich, plan, and — after a human approval — patch it with real Ansible and prove it's gone with a real re-scan.

Why this shape

CSX asked to stop simulating

The earlier demo simulated findings. CSX wanted the OS-level Microsoft-patch demo redone at the platform level on Linux, with a real scanner and real Ansible — and run in our environment, not theirs.

The boundary

Nothing of CSX's is touched

The whole lab runs in containers on one machine, on an isolated network. It resets in seconds and is fully repeatable. The same connectors point at CSX's real Qualys + Ansible the day they pilot inside their estate.

The platform itself is unchanged The twelve agents, the signed message bus, the reasoning-trace ledger, the policy gate, and the console are the real Mythal product. The POC swaps the simulated edges (findings in, patch out) for real connectors. That swap is the entire POC.
The whole estate

13 containers, three groups

Group 1 · Mythal platform (real product)

The control plane + console

api:8090
console:3090
postgres:5440
redis:6390

Twelve agents, policy gate, reasoning-trace ledger, the dashboard CSX watches.

Group 2 · Vulnerable targets (real software)

Real Linux hosts, on purpose old

target-tomcat:2210
target-log4shell:2211
target-liberty:2212
target-activemq:2213
target-jetty:2214
Group 3 · Lab services (the real edges)

Scanner · patcher · integrations

scanner:8096
ansible-control:8099
servicenow:8097
qualys:8098

Plus an on-demand orchestrator that can run the loop without the UI.

All on the isolated poc-net bridge. The Mythal api joins that network so the agents can reach the scanner, Ansible, ServiceNow and Qualys connectors directly.

Every container

What each one is and what it runs

ContainerBase / imageWhat it runsReal?
sentinelgrid-apipython:3.12FastAPI · 12 agents · policy gate · POC connectorsREAL
sentinelgrid-consolenode / Next.js 15The dashboard (Command Center, Findings, Plans, Activity, Integrations)REAL
sentinelgrid-postgres / redispostgres:16 · redis:7Findings, plans, executions, traces · message busREAL
poc-target-tomcatubuntu:20.04 + JREApache Tomcat 9.0.30 (+ sshd)REAL
poc-target-log4shellubuntu:20.04 + JREJava app bundling log4j-core 2.14.1 (+ sshd)REAL
poc-target-libertyubuntu:20.04 + JREOpen Liberty 21.0.0.11 (+ sshd)REAL
poc-target-activemqubuntu:20.04 + JREApache ActiveMQ 5.17.3 (+ sshd)REAL
poc-target-jettyubuntu:20.04 + JREEclipse Jetty 9.4.43 (+ sshd)REAL
poc-scannerpython:3.12 + TrivySSH version-probe + Trivy; serves canonical + Qualys-XML findingsREAL
poc-ansiblepython:3.12 + ansible-coreReal ansible-playbook runner over SSHREAL
poc-servicenowpython:3.12 / FastAPIServiceNow Table API — real API shape, mock backendAPI SHAPE
poc-qualyspython:3.12 / FastAPIQualys VMDR API — real API shape over real findingsAPI SHAPE
The five targets

Real platform software, deliberately old

HostSoftwareInstalledWhy this onePatched to
target-tomcatApache Tomcat9.0.30The web/app server everyone runs; the famous Ghostcat flaw9.0.89
target-log4shellApache Log4j2.14.1The library inside everything; the CVE every CISO fears2.17.1
target-libertyOpen Liberty (WebSphere family)21.0.0.11The WebSphere-family runtime CSX named on the call24.0.0.3
target-activemqApache ActiveMQ5.17.3Message broker; a CVSS-10 RCE actively used by ransomware5.18.3
target-jettyEclipse Jetty9.4.43Embedded server in countless Java apps9.4.53
i
Each host is a real Linux server Ubuntu base, SSH-enabled, the vulnerable software installed exactly as a real "default installation" would be — under /opt, started as a service. Ansible logs in over SSH and upgrades it, just like it would a real CSX host.
The vulnerabilities

Seven real CVEs · what an attacker actually does

CVE-2020-19389.8 KEV

Apache Tomcat "Ghostcat" (AJP)

Read or include arbitrary files (web.xml, configs, source) via the AJP connector — often a foothold to remote code execution. → fixed in 9.0.31+.

CVE-2021-4422810.0 KEV

Log4j "Log4Shell" (JNDI)

A single crafted log string triggers remote code execution. Mass-exploited within hours of disclosure; ransomware-linked. → fixed in 2.17.1.

CVE-2023-4660410.0 KEV

ActiveMQ OpenWire RCE

Unauthenticated remote code execution via the OpenWire protocol; used by HelloKitty and other ransomware crews. → fixed in 5.18.3.

CVE-2023-387377.5

Open Liberty SSRF

Server-side request forgery — coax the server into making attacker-chosen internal requests. → fixed in 24.0.0.3.

CVE-2020-94847.0

Tomcat session deserialization

If session persistence is enabled, a crafted session file leads to remote code execution. Cleared by the same Tomcat upgrade.

CVE-2021-45046 · CVE-2023-260499.0 / 5.3

Log4j follow-up · Jetty cookie leak

The incomplete-fix Log4j RCE/DoS, and a Jetty cookie-parsing flaw that can leak data across requests. → 2.17.1 / 9.4.53.

The honest answer

What's real, what's a stand-in

ElementStatusWhat that means exactly
Vulnerable softwareREALGenuine Tomcat / Log4j / Liberty / ActiveMQ / Jetty at real vulnerable versions.
Vulnerability detectionREALScanner SSHes in and reads the live installed version; Trivy bundled for OS-package breadth.
CVE knowledge (IDs, KEV, fix)CURATEDReal CVE IDs / severities, authored into a CVE map (not a live NVD/CISA pull in the POC path).
PatchingREALGenuine ansible-playbook over SSH upgrades the software and returns the real recap.
VerificationREALA real re-scan; the finding clears only because the version actually changed.
The twelve agents + policy gateREALThe real Mythal platform in deterministic agent mode (no external LLM key needed).
ServiceNow ITSMAPI SHAPEReal ServiceNow Table API path; in-memory backend. Swap base URL for a real instance.
Qualys scanner-of-recordAPI SHAPEReal Qualys VMDR API path over the lab's real findings. Swap base URL + creds for real Qualys.
The rail / MCR estate (4,310 assets)SIMULATEDThe separate demo tenant; clearly tagged SIMULATED. Not part of the real POC loop.
Demo conveniencesSIMULATEDRoot-password SSH and a one-click approver stand in for key auth and a full approval chain.
Why detection is real

It reads the live version, then matches CVEs

The method

For each host the scanner opens an SSH session and reads the actual installed version — the Tomcat symlink target, the log4j jar filename, the ActiveMQ/Jetty/Liberty install path. It compares that to a curated CVE table and reports what matches.

Because the version is read live, a finding can only clear after Ansible genuinely changes it. Nothing about "now it's fixed" is scripted. Trivy is bundled too, so OS-package CVEs are scanned by a real industry tool.

# live probe over SSH → real version readlink /opt/activemq /opt/apache-activemq-5.17.3 # matched against the CVE map CVE-2023-46604 affected <5.18.3 installed 5.17.3VULNERABLE fix 5.18.3 → feeds Patch Hunter + the Ansible playbook
Why patching is real

A genuine Ansible play, their exact tool

The flow

On approval, the Executor agent calls the Ansible control node, which runs a real ansible-playbook over SSH: snapshot for rollback, download the fixed version the scanner named, swap it in, restart the service. The real PLAY RECAP (ok / changed / failed) flows back into Mythal's execution timeline.

"Right now, we use Ansible" — CSX on the call. This is that, for real.

# a real recap returned to Mythal { "ok": true, "play_recap": { "target-activemq": { ok: 8, changed: 5, failed: 0 } }, "duration_s": 41.7 } # then a live re-scan → CVE gone → CLOSED
The integrations

ServiceNow & Qualys — real corporate shapes

ServiceNow · ITSM API SHAPE

The change & approval record

Speaks the real ServiceNow Table API (/api/now/table/change_request). When a host is remediated, Mythal opens a change, marks it approved at the gate, and closes it on verification — producing real CHG records. Point it at a real ServiceNow instance and only the URL changes.

Qualys · scanner of record API SHAPE

The Qualys VMDR API, emulated

Serves the lab's real findings on Qualys's actual API path (/api/2.0/fo/asset/host/vm/detection/) behind Basic auth. Mythal's Qualys connector talks to it identically to a real subscription.

Why not real Qualys? It's licensed cloud SaaS (agents report to Qualys' cloud) — it can't be self-hosted offline or run repeatably on a laptop. The emulator proves the integration now; the real connector is the production path.

What happens when you run it

Press the button — here's the chain

CLICK

"Run REAL POC scan" on the Command Center

The scanner SSHes into all five hosts, reads live versions, and reports 7 real CVEs.

AGENTS

The twelve agents process each finding

Scanner Liaison ingests → Threat Intel reconciles real KEV/EPSS → Patch Hunter names the fix → Impact + Change Risk score it → Planner writes the runbook. One plan per host.

GATE

Five plans wait at the human approval gate

The policy gate decides what needs sign-off. Nothing executes until you approve in the Plans board.

APPROVE

You approve → real Ansible runs

The Executor runs the real playbook over SSH, opens a ServiceNow change, and records the real recap.

VERIFY

The Verifier re-scans the host

A live re-scan confirms the version changed; every CVE on that host that cleared is closed, the change record is closed, compliance evidence is emitted.

What to expect

Timings and the verified outcome

Timing per host
~3s

Scan all five hosts

Live SSH version probe across the estate.

5–10s

Tomcat · Log4j · Jetty patch

Small download, swap, restart, re-scan.

~40s

Liberty · ActiveMQ patch

They download a larger fixed runtime — expect a longer bar.

Verified result

7 / 7 findings closed

In the verified run: 5 host plans, each patched once by real Ansible; the host-wide re-scan closed all 7 CVEs (including the two second-CVEs that ride the same host patch). ServiceNow shows the closed changes; the Qualys API returns an empty detection list.

Plans
5 closed
Findings
7 closed
False closes
0
!
If a re-scan still flags a CVE The platform escalates instead of falsely closing — exactly what you want. In the POC every host clears because each is a genuine version upgrade.
Who does the work

The agents that drive the real loop

★ ORCHESTRATOR

Supervisor

Runs the FSM, routes POC plans to the real executor

01 · DETECT

Scanner Liaison

Ingests real scanner findings

02 · ENRICH

Threat Intel

Reconciles real KEV / EPSS

03 · ENRICH

Patch Hunter

Names the fixed version

04 · SCORE

Impact Analyst

Asset criticality + blast radius

05 · SCORE

Change Risk

Failure-rate + window

06 · PLAN

Remediation Planner

Runbook + rollback, one per host

07 · ACT

Executor

Runs the real ansible-playbook

08 · VERIFY

Verifier

Live re-scan, closes cleared CVEs

09 · AUDIT

Compliance Reporter

Evidence on close

10 · SAFETY

OT Safety Officer

Veto rights (OT path)

11 · INSIGHT

Inventory Insights

EOL / sprawl / shadow IT

Operate it

Run it, watch it, reset it

From the console
1

Open the Command Center

http://localhost:3090

2

Click "🛰️ Run REAL POC scan"

7 real CVEs land; 5 host plans appear.

3

Plans → Approve each host

Watch real Ansible patch + re-scan close it. Traces in Activity.

# bring everything up cd sentinelgrid && docker compose up -d cd simulators/poc-lab && ./scripts/up.ps1 # reset targets to vulnerable for a fresh run ./scripts/reset.ps1 # clear plans from the board curl -X POST http://localhost:8090/api/admin/reset # (optional) run the loop headless docker compose -f docker-compose.poc.yml ` run --rm orchestrator
Why it matters

What this proves for CSX

It's real

Real scan, real patch, real proof

Not a slideshow and not a simulation — real vulnerable software, a real scanner, real Ansible, and a real re-scan that proves the fix. On a laptop, repeatable in seconds.

It's safe

Human gate + honest verification

Nothing executes without approval; the platform escalates rather than falsely closing. The OT Safety Officer holds veto rights on the OT path.

It's their stack

Qualys + Ansible + ServiceNow

The exact tools CSX named. The connectors are a base-URL swap from pointing at CSX's real Qualys, Ansible Automation Platform, and ServiceNow when they pilot inside their estate.

From a real CVE on a real container to a verified, evidenced fix — driven by twelve agents, gated by a human, proven by a re-scan. That is the whole demo, and it runs today.
Reference

Endpoints & access

SurfaceURLUse
Consolehttp://localhost:3090The dashboard — Command Center, Findings, Plans, Activity, Integrations
Presentation portalhttp://localhost:8090/presentation/This deck + the plan + lab internals
APIhttp://localhost:8090/api/poc/scan · /api/poc/health · /api/plans · /health
Scannerhttp://localhost:8096POST /scan/run · /findings · /findings/qualys
ServiceNow (mock)http://localhost:8097/api/now/table/change_request
Qualys (emulator)http://localhost:8098/api/2.0/fo/asset/host/vm/detection/ · Basic qualys_poc
Ansible controlhttp://localhost:8099POST /run · /health
Targets (SSH)localhost:2210-2214root / ansible — inspection only

All host ports sit outside the in-use block on this machine. The lab runs entirely over its internal poc-net bridge; exposed ports are for inspection and demo convenience.