Skip to main content

Feature Overview

Patch Management is organized as Home, Risk Governance, Patch Library, Baselines, Targets, and Settings.

1. Home​

Home summarizes enrollment, coverage, compliance, risk, and exceptions, and starts an immediate assessment of the visible enrolled hosts.

  • Coverage uses hosts that are bound to a baseline. The compliance rate counts only hosts with a definite result. Unconfigured, pending, failed, unknown, and not-applicable results are excluded.
  • The compliance distribution follows the current user's data permissions.
  • Recent tasks open execution records. Frequent risks use the current valid assessment.
  • An immediate assessment does not depend on the scheduled-assessment switch.

2. Risk Governance​

2.1 Pending risks​

View gaps by patch, host, or baseline. A risk is shown only when you can see the host, the patch, and the baseline. Only a confirmed missing requirement from a current valid assessment becomes risk. Remediate immediately or in a window. The host must be bound to a baseline that contains the patch. Immediate tasks on the same host are mutually exclusive. Reboot applies only to hosts waiting for reboot and requires a window. A successful install with no reboot is rechecked automatically. A host that needs a reboot is rechecked after it recovers. A failed install does not create an automatic recheck. A timeout starts with a read-only check. Export the loaded page or the selected aggregated items. The Export all label means the loaded page, not the full risk set. The workbook summary links to the first detail row.

2.2 Execution records​

Keep install and reboot progress, host stage, and logs. A stale execution cannot overwrite the current state. Cancel only an operation that has not been dispatched, and provide a reason. Retry a failed, unknown, or unsatisfied host by naming the target. Export all or selected records within your data permissions.

3. Patch Library​

Maintain Windows and Linux patches separately. Search, view, create, edit, and delete them. Sync from a source by previewing candidates and selecting what to import. Severity can be changed at import time. The candidate list cannot be empty. Windows packages can be uploaded or replaced, and an empty upload is rejected. A patch used by a baseline or an active remediation cannot be deleted. Severity is critical, important, moderate, low, or unspecified. Patch kind is security or general.

4. Baselines​

Create Windows and Linux baselines separately. Add or remove patch requirements without duplicating a patch. Bind hosts, with one baseline per host. Changing requirements or bindings invalidates the old assessment. Assessment is blocked when there are no requirements or no hosts, and the baseline cannot be edited while a remediation task is active. The compliance matrix has host and patch views, supports multi-select, and exports assessment detail from either view. A superseding Windows KB synchronized from WSUS can satisfy the corresponding requirement when that update is already installed.

5. Targets​

Enter a Windows or Linux host manually, or create targets from at least one Node Management node. Test connectivity before save and again after connection details change. The list shows operating system, architecture, source, connectivity, current baseline, latest compliance, and last assessment time. Open a host's risks from the row.

6. Settings​

6.1 Patch sources​

Sources are WSUS, yum, dnf, and apt. Other sync protocols and automatic discovery of arbitrary third-party sources are not included. Built-in public YUM, DNF, and APT sources are available. Create, edit, delete, and enable or disable sources. A custom source belongs to the current organization. Test an unsaved form or a saved source, including batch tests. Preview and import happen in the library.

6.2 Scan settings​

Scheduled assessment is one global setting. Turning it off does not block manual assessment. Hourly intervals are at least one hour. Daily uses hour and minute. Weekly uses a weekday and a time, Monday through Sunday. The schedule uses the user's IANA time zone. Notification can summarize non-compliant or failed hosts.

Note: There is no vulnerability-intelligence search. Production Windows assessment currently records satisfied, missing, and unknown. Do not promise automatic not-applicable judgment. A baseline is the current fixed list and has no historical versions.