Skip to main content

Product Introduction

Overview​

Patch Management is for teams that need to keep finding and fixing missing host patches. The loop is source, library, target host, baseline, assessment, and remediation. A patch enters the library, a host is enrolled, a baseline says which patches that host must have, assessment finds confirmed gaps, and installation runs in a window you choose.

Windows and Linux are both covered. Sources are Windows Server Update Services and Linux yum, dnf, and apt repositories. Built-in public YUM, DNF, and APT sources are available so the first assessment does not require a private repository.

Core Advantages​

  1. A baseline defines compliance
    Windows and Linux baselines are separate. A host is bound to only one baseline at a time. Changing requirements or bindings invalidates the previous assessment. A baseline with no requirements or no hosts cannot be assessed.

  2. Risk comes only from a confirmed missing requirement
    Assessment can record satisfied, missing, and unknown. Only a still-valid confirmed miss becomes a pending risk. Unknown, unconfigured, pending, and expired results are not current risk.

  3. Install, reboot, and recheck stay on one execution record
    Remediate immediately or in an execution window. A host that must reboot gets its own reboot window. Successful installs that do not need a reboot are rechecked automatically. Hosts that need a reboot are rechecked after they come back. A timeout starts with a read-only check so a change that may already have applied is not sent again.

  4. Enroll hosts by hand or from Node Management
    The target list shows operating system, architecture, source, connectivity, current baseline, and latest compliance. Changing connection details triggers a new connectivity check.

Use Cases​

  • Hold a patch floor for a fixed set of hosts
    Create a production baseline, bind hosts, and assess hourly, daily, or weekly. Send a summary when hosts are non-compliant or assessment fails.

  • Install missing patches in a maintenance window
    Select risk by patch, host, or baseline, schedule install or reboot, and read each host's stage in the execution record.

  • Prove the loop with a public repository
    Enable a built-in YUM, DNF, or APT source, import a few patches, bind a small set of hosts, and confirm connectivity, assessment, and risk.