CSX POC · the real lab, explained

How the real loop actually runs.

This is the operator's view of the POC lab: every container, every port, the exact path a real CVE travels from a real scan to a real Ansible patch to a real re-scan that proves it's gone. Nothing here is simulated — the software is real, the scanner reads real installed versions, and the patch is a genuine ansible-playbook run.

Trace the loop → How to run it Print as PDF

Total containers

14

9 lab + 4 Mythal + 1 tool

Vulnerable targets

5

real middleware + OS

Real scanner

✓

version probe + Trivy

Real patcher

Ansible

Integrations

ServiceNow
+ Qualys

Reset

<30s

The goal

What this lab proves

The claim

Machine-speed remediation, for real

CSX saw the simulated loop. This lab shows the same loop running on real software: real CVEs in real Tomcat / Liberty / log4j / OS packages, found by a real scanner, fixed by real Ansible.

The constraint

In our environment, nothing of theirs

Everything runs in containers on one machine, on an isolated network. No CSX system is touched, no approvals needed. Repeatable in seconds, demoable on a laptop.

The proof

Truthful, not staged

The scanner reads the real installed version over SSH. A finding clears on re-scan only because Ansible genuinely changed the version — there is no scripted "now it's fixed."

→

Same console, real inputs The Mythal control plane — the twelve agents, the policy gate, the reasoning-trace ledger, the console CSX already saw — is unchanged. The lab swaps the simulated edges for real connectors. That is the entire POC.

01 · SCAN

scanner

SSH version probe → real CVE with CVSS/KEV + fixed_version

02 · TICKET

servicenow

Opens a change_request (CHG…) for the patch

03 · APPROVE

policy gate

Human approval moves change to approved

04 · PATCH

ansible-control

Real ansible-playbook upgrades the target

05 · VERIFY

scanner

Re-scan: version changed → finding clears

06 · CLOSE

servicenow

change_request closed · loop complete

The one detail that makes it real

The scanner's fixed_version for each CVE is the single source of truth: the Patch Hunter reports it, and the Ansible playbook installs exactly that version. The fix the scanner names is the fix that gets applied — no guessing, no drift.

Two ways to drive it

Standalone: the orchestrator container runs steps 1–6 and prints them — proves the software loop on its own.

Through Mythal: the twelve agents drive the same connectors, so the console shows the loop with full reasoning traces (the wiring milestone).

Under the hood · scanner

It reads the real version, then matches CVEs

How a finding is produced

SSH

Probe the installed version

e.g. readlink /opt/tomcat → apache-tomcat-9.0.30; or the log4j jar filename; or dpkg-query for OpenSSL.

MATCH

Compare to the CVE table

cve_map.yaml holds the affected range + fixed_version per CVE. In-range → finding emitted.

EMIT

Two output shapes

Canonical JSON for the Scanner Liaison, and Qualys-VMDR XML for the Qualys connector.

# cve_map.yaml — one source of truth
target-tomcat:
  probe: { type: readlink, path: /opt/tomcat,
           regex: 'apache-tomcat-([0-9.]+)' }
  playbook: remediate_tomcat.yml
  cves:
    - id: CVE-2020-1938   # Ghostcat
      cvss: 9.8
      kev: true
      affected: "<9.0.31"
      fixed_version: "9.0.89"  # → Ansible

Under the hood · ansible

The patch is a genuine playbook run

The flow

The Executor (or the orchestrator) POSTs to ansible-control:8099/run with the playbook, the target, and the scanner's fixed_version. The control node shells out to a real ansible-playbook over SSH, snapshots the target for rollback, upgrades the software, restarts the service, and returns the real PLAY RECAP.

That recap (ok / changed / failed) is exactly what lands in the Mythal executions table and streams to the console — same UI as the simulated path, now backed by a real change on a real host.

# POST /run → real ansible-playbook
{
  "playbook": "remediate_tomcat.yml",
  "target":   "target-tomcat",
  "fixed_version": "9.0.89"
}
# ← real recap returned
{
  "ok": true,
  "play_recap": {
    "target-tomcat": { ok: 9, changed: 6, failed: 0 }
  },
  "duration_s": 11.4
}

Corporate integrations

ServiceNow and Qualys — real shapes

ServiceNow · ITSM

The change & approval workflow

Serves the real ServiceNow Table API path — /api/now/table/change_request. Mythal opens a change when a plan is built, reads approval at the gate, and closes it on verification. Point the connector at a real ServiceNow instance and only the base URL changes.

Qualys · scanner of record

The Qualys VMDR API, emulated

Serves the lab findings on Qualys's real path — /api/2.0/fo/asset/host/vm/detection/ — behind HTTP Basic auth. Mythal's Qualys connector talks to it exactly as it would to a real subscription. When CSX is ready, swap the base URL + credentials; nothing else changes.

!

Why not install real Qualys Qualys is licensed cloud SaaS — agents report to Qualys' cloud, so it can't be self-hosted offline or run repeatably on a laptop. The emulator proves the integration shape now; the real connector is the production path later.

Operate it

Bring it up and run the loop

# 1 · Mythal app (console + agents)
cd sentinelgrid
docker compose up -d --build
# console  → http://localhost:3090
# api      → http://localhost:8090

# 2 · The POC lab (real targets + scanner + ansible)
cd simulators/poc-lab
./scripts/up.ps1

# 3 · Run the real end-to-end loop
docker compose -f docker-compose.poc.yml `
  run --rm orchestrator

# 4 · Reset targets to vulnerable, run again
./scripts/reset.ps1

What you'll see

The orchestrator prints each step with the real CVEs, the real ServiceNow change numbers, and the real Ansible recap:

SCAN

Real findings appear

CVE-2021-44228 on target-log4shell, KEV, CVSS 10.0, fix 2.17.1.

PATCH

Ansible actually runs

changed=6, failed=0 — the jar on disk is replaced.

VERIFY

Re-scan is clean

The CVE is simply no longer there.

Reference

Service endpoints & health checks

Service	URL	Key endpoints	Health
Mythal console	`localhost:3090`	Command Center, Findings, Plans, Activity, Integrations	open in browser
Mythal API	`localhost:8090`	`/health`, `/api/*`, `/presentation/`	`/health`
Scanner	`localhost:8096`	`POST /scan/run`, `/findings`, `/findings/qualys`	`/health`
Ansible control	`localhost:8099`	`POST /run`, `/ping`	`/health`
ServiceNow (mock)	`localhost:8097`	`/api/now/table/change_request`	`/health`
Qualys (emulator)	`localhost:8098`	`/api/2.0/fo/asset/host/vm/detection/`	`/health`
Targets (SSH)	`localhost:2210-2214`	`root` / `ansible` (debug only)	—

All host ports sit outside the in-use block on this machine. The lab runs entirely over its internal poc-net bridge; the exposed ports are for inspection and demo convenience.

Where this goes

From standalone loop to agent-driven console

Done

The real software loop

Five vulnerable targets, a real scanner, real Ansible, ServiceNow + Qualys integration shapes, and an orchestrator that proves scan → patch → verify end to end.

Point the Mythal Scanner Liaison, Executor, and Verifier at packages/connectors/poc/ so the console shows the real loop with full agent reasoning traces — not the standalone orchestrator.

Then

Raise the fidelity

Add OpenVAS for a "watch a network scan" moment, AWX for a real Ansible job-template UI, and more targets — each is a documented drop-in.

Real software, a real scanner, a real patch, a real re-scan — repeatable on one laptop, and the same connectors point at CSX's real Qualys and Ansible the day they want a pilot inside their estate.

How the real loop actually runs.

What this lab proves

Machine-speed remediation, for real

In our environment, nothing of theirs

Truthful, not staged

Every container in the lab

target-tomcat

target-log4shell

target-liberty

target-linux

target-nginx

scanner

ansible-control

servicenow

qualys

orchestrator

api

console

postgres

redis

The path of one real CVE

It reads the real version, then matches CVEs

Probe the installed version

Compare to the CVE table

Two output shapes

The patch is a genuine playbook run

ServiceNow and Qualys — real shapes

The change & approval workflow

The Qualys VMDR API, emulated

Bring it up and run the loop

Real findings appear

Ansible actually runs

Re-scan is clean

Service endpoints & health checks

From standalone loop to agent-driven console

The real software loop

Wire the twelve agents

Raise the fidelity