How mizcausevic-dev/servicenow-cyberark-evidence-pipeline works
Purpose and principal workflow: An external HTTP client requests the FastAPI application’s incident, dashboard, or evidence-bundle endpoints. The application loads a seeded incident dataset and serves computed risk evaluations, review-ready bundle representations, and operational/security posture views as JSON or HTML. Although the product is framed as a ServiceNow–CyberArk evidence pipeline, the sampled implementation models those systems’ data and posture; it does not establish live connections or a background ingestion workflow.
Components
HTTP API and page routing
• FastAPI application — app/main.py: Defines the FastAPI app, initializes its service instance, and exposes HTML and JSON routes; its command-line entry starts Uvicorn.
• HTTP caller — null: External clients initiate the workflow by requesting the application’s documented pages or API endpoints.
Evidence data and evaluation
• Seed incident dataset — app/data/sample_pipeline_data.json: Supplies the incident records loaded by the service; it is sample data, not evidence of a live ServiceNow feed.
• Pipeline service and risk evaluation — app/services/evidence_pipeline_service.py: Loads the dataset and derives incident catalogs, risk verdicts, summaries, board items, evidence-bundle representations, audit/terminal feeds, and posture payloads. Its scoring and bundle-building helpers are internal stages of this same service.
Presentation and operational surfaces
• HTML control surfaces — app/render.py: Builds the dashboard, pipeline board, bundle, audit, integration, monitor, security/architecture, methodology, and documentation pages by rendering service-produced data.
• ServiceNow — null: A modeled source of incident and workflow context in the product description and posture views; live calls are not established by the sampled code.
• CyberArk Vault — null: A modeled source of safe/account and privileged-access context; live calls are not established by the sampled code.
• Governance and audit consumers — null: Downstream review, certification, and audit targets are represented in the product’s posture and bundle concepts; actual exports or consumer connections are not established.
Relationships
• HTTP caller -> FastAPI application: Sends HTTP requests to the application’s routes.
• FastAPI application -> Pipeline service and risk evaluation: Calls service methods to produce JSON response data; the application constructs a service instance during module initialization.
• Pipeline service and risk evaluation -> Seed incident dataset: Reads and parses the JSON payload to initialize its incident records.
• FastAPI application -> HTML control surfaces: Calls the corresponding render functions for page requests.
• HTML control surfaces -> Pipeline service and risk evaluation: Calls service methods to obtain data for rendered views; the renderer constructs its own service instance.
• Pipeline service and risk evaluation -> Pipeline service and risk evaluation: Evaluates incident attributes into risk scores/verdicts and uses evaluation results when assembling bundle representations.
• Pipeline service and risk evaluation -> ServiceNow: No runtime interaction established; ServiceNow is represented in modeled data and descriptive posture.
• Pipeline service and risk evaluation -> CyberArk Vault: No runtime interaction established; vault enrichment appears in modeled posture and audit/terminal content.
• Pipeline service and risk evaluation -> Governance and audit consumers: No runtime export established; certification and audit handoff are represented in returned data and product descriptions.
Coverage limits: The service excerpt omits substantial portions of its implementation, and the architecture documentation was not sampled. The available evidence establishes local seeded-data processing and HTTP presentation, but not live connector behavior, authentication, persistence beyond the in-memory service data, or downstream delivery.
Main entry points: evidence_pipeline_service.py Evidence pipeline · main.py FastAPI app · render.py HTML renderer · sample_pipeline_data.json Seed incidents
Components 8
Evidence Evaluation
Seeded incident data and in-memory risk and bundle processing.
- Evidence pipeline
app/services/evidence_pipeline_service.py - Seed incidents · Local sample data; not a live ServiceNow feed.
app/data/sample_pipeline_data.json
Other components
- HTTP caller
- ServiceNow · Incident and workflow context is represented in data and posture views; no live calls are established.
- CyberArk Vault · Safe, account, and privileged-access context is represented in posture and audit content; no live calls are established.
- Governance and audit · Review, certification, and audit targets are represented in returned data; no downstream exports are established.
Connections 6
- HTTP caller → FastAPI app: sends requests
- FastAPI app → Evidence pipeline: calls service · The application constructs a service instance during module initialization.
- Evidence pipeline → Seed incidents: reads dataset · Loads and parses the JSON payload to initialize incident records.
- FastAPI app → HTML renderer: calls renderers
- HTML renderer → Evidence pipeline: gets view data · The renderer constructs its own service instance.
- Evidence pipeline → Evidence pipeline: evaluates and bundles · Evaluates incident attributes into risk scores and verdicts, then uses evaluation results in bundle representations.