Platform Architecture

PUDICA ART CI/CD Orchestration.

A centralized CI/CD SaaS engine orchestrating continuous production security. The PUDICA ART engine governs local agents, manages TARSM vulnerability workflows, and drives full-domain GoldenVault validations via strict GitHub integration.

One Core Engine. Three Extended Capabilities.

PUDICA ART is the foundational SaaS ecosystem executing Automated Remediations. However, by leveraging this exact same shift-left GoldenVault architecture, organizations can seamlessly extend their SecOps capabilities into SIEM Optimization and active Disaster Recovery drills.

Sense (Automated Remediations)

PUDICA ART Core

The foundation. The orchestration engine bridges the local sense_agent to extract CPaC states, validating forward-fixing remediations dynamically within the GoldenVault without fear of production impact.

React (CaSIEM & IR)

Analysis Extension

Leverages the Analysis Engine to test exploits against the twin, capturing attack surface telemetry to forge zero-noise SOC rules and execute automated Incident Response playbook simulations.

Recover (BCP/DR)

Analysis Extension

Replaces idle DR resources. Executes on-demand dynamic BCP/DR operations inside the GoldenVault testbed, validating recovery scripts to provision secure infrastructure instantly during an incident.

SaaS Architecture

The PUDICA ART Orchestration Flow.

Scroll down to explore how the central orchestration engine drives the entire CI/CD pipeline step-by-step—from the local agent to the GoldenVault, and finally back to production.

Sense_Scan
Orchestrator
Target System
sense_agent
GitHub Repo
CPaC_backup
GitHub Repo
CPaC_backup
GV_Manage
CD Engine
GoldenVault Isolated Domain
Dynamic OS
EntraID/AD
Splunk/Sentinel
Tenable API
vuln_ingest
CP_DB_index
Asset Inventory
TARSM Module
Correlation
ARF Tickets
Ready for Test
Analysis Engine
Validation Core
Attack Surface Valid.
TTP & SIEM Logs
Remediation Valid.
BIA / Comfort
Restore Valid.
Rollback Script
Sense_Scan
Orchestrator
sense_agent
Deploy/Verify
Target System
Live Prod
TARSM
Auto Incident

a) Sense_Scan (CI/CD)

The perimeter connection point. The Sense_Scan orchestrator commands the local sense_agent residing in your target VLAN to audit compliance, acquire configuration data, and execute validations.

Upon data acquisition, the agent orchestrates the push to GitHub version control, storing the Ansible code as a CPaC, and dynamically updates the SAF (Sense Audit Findings) dashboard.

sense_agent CP_DB_index CPaC_backup

b) GoldenVault_manage

The Continuous Deployment (CD) build engine. It acts as the infrastructure bridge between your GitHub repository and the isolated testing environments.

It automatically pulls the acquired CPaC_backup code from GitHub to dynamically build a fully hydrated mirrored domain. This is not a static OS image. The GoldenVault is an isolated network domain natively equipped with AD/EntraID and test Splunk/Sentinel servers for comprehensive, full-stack CIS validation.

CPaC_backup Dynamic Domain Cluster

c) TARSM & Vuln Ingest

The Threat-Informed Automated Remediation Service Management (TARSM) layer. It connects via API to scanners like Tenable/Qualys through the vuln_ingest module.

It ingests vulnerability data and correlates it directly against the Sense_scan audit findings and the CP_DB_index. It then automatically generates actionable ARF (Auto Remediation Findings) tickets to track the validation lifecycle.

vuln_ingest (API) Auto_Remediation_Findings

d) Analysis Intelligence

The intelligence brain driving all validations. It connects to the GoldenVault system to independently test the specific vulnerabilities flagged in the ARF tickets.

It executes distinct checks natively against the mirrored environment: Attack Surface Validations (TTP exploits and SIEM logs review), Remediation Validations (BIA checks), and Restore Validations. Upon completion, it updates the results in the respective ARF tickets and synchronizes the verified code back to GitHub.

SIEM_rule Auto_Recovery Auto_Remediations

e) Live Fix & Verify

Closing the CI/CD loop securely. The Sense_Scan orchestrator commands the local sense_agent to pull the final, verified auto-remediation code and apply it directly to the target system.

The agent conducts an immediate verification test. If the fix fails or causes impact, the agent executes an automatic restore procedure and reports back to Sense_Scan, which automatically raises an incident in TARSM for further Business Impact Analysis.

sense_agent (Apply) Incident (Fail Route)
CI/CD PIPELINE WORKFLOW

The 8-Stage ProdSecOps Lifecycle.

This represents the chronological orchestration workflow. The sense_scan module triggers the local agent to audit and acquire configurations. All remediations are rigorously validated in the GoldenVault and synchronized through GitHub before the sense_agent applies and verifies the final fix on live production.

PROD SEC OPS
1. Sense Audit & Acquire1. Sense
2. GoldenVault Build2. GV Build
3. TARSM Vuln Ingest3. Ingest
4. Attack Surface Valid.4. Attack Valid.
5. Remediation Valid.5. Patch Valid.
6. Recovery Valid.6. Recov Valid.
7. GitHub CI/CD Sync7. GitHub Sync
8. Live Fix & Verify8. Live Fix
Stage 01

Sense Audit & Acquire

Engine: Sense_Scan Target: Local Agent

The Sense_Scan module triggers the local sense_agent to audit compliance and acquire forensics configurations. It stores the result in GitHub CPaC_backup and CP_DB_index, updating the SAF Dashboard.

> [sense_agent] Executing scheduled audit task...
> Acquiring forensics configurations...
> Pushing to GitHub repo: CPaC_backup
> SAF (Sense_audit_findings) Dashboard Updated.
Stage 02

GoldenVault CD Build

Engine: GoldenVault_mgt Target: Testbed

The GoldenVault_manage continuous deployment engine triggers to pull the CPaC_backup from GitHub, dynamically building the mirrored GoldenVault system equipped with test Splunk/Sentinel servers.

> [goldenvault_cd] Pulling CPaC_backup from Git...
> Provisioning mirrored infrastructure...
> Initializing Sentinel & Splunk logging nodes...
> GoldenVault Testbed Online.
Stage 03

TARSM Vuln Ingestion

Engine: TARSM Target: ITSM Workflow

The vuln_ingest module connects via API to Tenable/Qualys. TARSM maps the vulnerabilities to the CP_DB_index inventory, generating ARF (Auto_Remediation_Findings) tickets sorted by severity.

> [vuln_ingest] Polling Tenable API...
> Mapping findings to CP_DB_index assets...
> Generating ARF Tickets: 2 Critical, 5 High.
> VAF Dashboard Synced.
Stage 04

Attack Surface Validation

Engine: Analysis Target: GoldenVault

The Analysis Intelligence engine drives attack surface validations inside the GoldenVault. It detonates exploits, reviews SIEM logs, and updates the ARF ticket with empirical exploitability results.

> [analysis] Detonating payload in GoldenVault...
> Reviewing SIEM logs (Splunk/Sentinel)...
> Exploit successful. Log signature extracted.
> ARF Ticket Updated: Patch Required.
Stage 05

Remediation Validation

Engine: Analysis Target: GoldenVault

The Analysis engine applies the proposed fix to the GoldenVault twin, executing strict comfortability and BIA (Business Impact Analysis) checks to ensure zero breakage. Results update the ARF ticket.

> [analysis] Applying remediation to GoldenVault...
> Executing Comfortability & BIA tests...
> assert: HTTP 200 OK == True.
> ARF Ticket Updated: Fix Validated.
Stage 06

Recovery Validation

Engine: Analysis Target: GoldenVault

The Analysis engine tests the backward-recovery (rollback) script inside the GoldenVault. It ensures that if a live patch fails, the system can autonomously restore itself without impact.

> [analysis] Executing recovery script test...
> Target restored safely to CPaC_backup state.
> Recovery validation passed.
> ARF Ticket Updated: Rollback Verified.
Stage 07

GitHub CI/CD Sync

Engine: Policy_Hub Target: Repositories

All GoldenVault-verified outputs are synchronized back to the GitHub repositories via CI/CD. This updates the SIEM_rule, Auto_Recovery, Exception_risk_index, and Auto_Remediations repos.

> [ci_cd] Syncing validated outputs to GitHub...
> git push origin main -> Auto_Remediations
> git push origin main -> Auto_Recovery
> Repositories updated successfully.
Stage 08

Live Fix & Verify

Engine: Sense_Scan Target: Local Agent

The Sense_Scan orchestrator commands the sense_agent to pull the validated fix and apply it. If it fails the live verification, the agent auto-restores and raises an incident in TARSM.

> [sense_agent] Pulling Auto_Remediation script...
> Applying fix to live target...
> Verifying live state... SUCCESS.
> ARF Ticket Closed. Loop restarting.

Unify the Stack. Reclaim the Advantage.

Discover how the PUDICA ART Orchestration Engine protects your infrastructure at machine speed.