<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-patch-management-automation
description: >-
  Automate patch management lifecycle including patch discovery, testing,
  approval workflows, deployment scheduling, rollback procedures, and
  compliance verification across heterogeneous infrastructure.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - patch-management
  - automation
  - wsus
  - ansible
  - sccm
  - compliance
  - deployment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Patch Management Automation

## Overview

Manual patching does not scale. Automated patch management ensures consistent,
timely remediation across thousands of endpoints while maintaining change control,
rollback capability, and compliance evidence. This skill covers patch discovery,
testing pipelines, approval workflows, phased deployment, and verification using
Ansible, WSUS, and cloud-native tools.

Mode: `[MODE: BLUE]` — Defensive patch management and hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| Ansible 2.15+ or SCCM/WSUS for Windows environments | Required |
| SSH access to Linux targets, WinRM for Windows targets | Required |
| Python 3.10+ with `requests` | Required |
| Change management system for approval workflows | Required |
| Test environment mirroring production | Required |

## Key Concepts

### Patch Deployment Pipeline

```
1. Discovery   → Scanner identifies missing patches
2. Assessment  → Evaluate patch impact and dependencies
3. Testing     → Deploy to test environment, run smoke tests
4. Approval    → Change Advisory Board (CAB) or auto-approve by tier
5. Staging     → Deploy to canary/staging hosts (5%)
6. Production  → Phased rollout (25% → 50% → 100%)
7. Verification → Rescan to confirm patch applied
8. Rollback    → Automated rollback on failure detection
```

### Ansible Patch Automation

```yaml
# Linux patching playbook
---
- name: Automated security patch deployment
  hosts: "{{ target_group }}"
  become: true
  serial: "25%"
  max_fail_percentage: 10

  tasks:
    - name: Create pre-patch snapshot
      command: "lvcreate -s -n pre_patch_snap -L 10G /dev/vg0/root"
      ignore_errors: true

    - name: Update security packages (RHEL/CentOS)
      ansible.builtin.yum:
        name: "*"
        state: latest
        security: true
        update_cache: true
      when: ansible_os_family == "RedHat"

    - name: Update security packages (Debian/Ubuntu)
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == "Debian"

    - name: Check if reboot required
      stat:
        path: /var/run/reboot-required
      register: reboot_required

    - name: Reboot if required
      ansible.builtin.reboot:
        reboot_timeout: 300
      when: reboot_required.stat.exists | default(false)
```

### WSUS Patch Management

```powershell
# PowerShell — approve patches in WSUS
$wsus = Get-WsusServer -Name "wsus.internal" -PortNumber 8530
$updates = Get-WsusUpdate -UpdateServer $wsus -Classification SecurityUpdates -Status FailedOrNeeded
$updates | Approve-WsusUpdate -Action Install -TargetGroupName "Production Servers"

# Check patch compliance
Get-WsusComputer -UpdateServer $wsus | ForEach-Object {
    $status = $_.GetUpdateInstallationSummary()
    [PSCustomObject]@{
        Computer = $_.FullDomainName
        Needed = $status.NotInstalledCount
        Failed = $status.FailedCount
    }
}
```

### AWS Systems Manager Patch Manager

```bash
# Create patch baseline
aws ssm create-patch-baseline \
  --name "SecurityPatches" \
  --approval-rules '{
    "PatchRules": [{
      "PatchFilterGroup": {
        "PatchFilters": [{"Key": "CLASSIFICATION", "Values": ["SecurityUpdates"]}]
      },
      "ApproveAfterDays": 0,
      "ComplianceLevel": "CRITICAL"
    }]
  }'

# Run patch scan
aws ssm send-command \
  --document-name "AWS-RunPatchBaseline" \
  --targets "Key=tag:PatchGroup,Values=Production" \
  --parameters '{"Operation":["Scan"]}'

# Install patches
aws ssm send-command \
  --document-name "AWS-RunPatchBaseline" \
  --targets "Key=tag:PatchGroup,Values=Production" \
  --parameters '{"Operation":["Install"],"RebootOption":["RebootIfNeeded"]}'
```

## Workflow

### Step 1: Discover Missing Patches

```bash
node scripts/agent.js --action discover \
  --input /tmp/scan_results.json \
  --output /tmp/missing_patches.json
```

### Step 2: Generate Deployment Plan

```bash
node scripts/agent.js --action plan \
  --input /tmp/missing_patches.json \
  --strategy phased \
  --output /tmp/patch_plan.json
```

### Step 3: Verify Deployment

```bash
node scripts/agent.js --action verify \
  --input /tmp/patch_plan.json \
  --output /tmp/patch_verification.json
```

## Detection

```yaml
title: Patch Management Automation Detection
id: 24640022-7090-48c0-817a-8b59733d82c5
status: experimental
description: Detects suspicious activity related to implementing patch management automation techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*patch*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Patch Management Automation Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Automated patch discovery running on scan schedule
- [ ] Test environment validated before production deployment
- [ ] Phased rollout with automatic failure detection
- [ ] Rollback procedures tested and documented
- [ ] Patch compliance tracked by asset group
- [ ] Reboot scheduling coordinated with maintenance windows
- [ ] Emergency patch process defined for zero-day response

## References

- [NIST SP 800-40 Rev 4 — Guide to Enterprise Patch Management](https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final)
- [CIS Controls v8 — Control 7.4: Automated Patch Management](https://www.cisecurity.org/controls)
- [AWS Systems Manager Patch Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html)
- [Ansible Patching Best Practices](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_module.html)
