<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-patch-management-workflow
description: >-
  Design and automate patch management workflows covering vulnerability-to-patch
  mapping, patch testing, staged rollout, rollback procedures, and compliance
  tracking across Linux, Windows, and containerized environments.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - patch-management
  - remediation
  - compliance
  - automation
  - ansible
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Patch Management Workflow

## Overview

Patch management bridges vulnerability discovery and remediation. A structured
workflow ensures patches are tested before deployment, rollback plans exist, SLAs
are tracked, and compliance evidence is generated. This skill covers CVE-to-patch
mapping, staged deployment, and verification automation.

## Prerequisites

| Requirement | Install |
|---|---|
| Ansible | `pip install ansible` |
| Python 3.10+ | Agent tooling |
| Nessus Professional | Vulnerability-to-patch correlation |
| apt/yum/dnf | Linux package managers |
| WSUS/SCCM | Windows patching (optional) |

## Key Concepts

### CVE-to-Patch Mapping

```bash
# Map CVE to package on Debian/Ubuntu
apt list --installed 2>/dev/null | grep -i openssl
apt changelog openssl 2>/dev/null | grep -i CVE-2024

# Map CVE to package on RHEL/CentOS
yum updateinfo list cves CVE-2024-3400
yum updateinfo info --cve CVE-2024-3400

# Nessus plugin-to-patch mapping via API
curl -sk -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/hosts/$HOST_ID" | \
  jq '.vulnerabilities[] | select(.severity >= 3) | {plugin_id, plugin_name, cve: .cpe}'
```

### Ansible Patch Playbooks

```yaml
# patch_linux.yml — Staged Linux patching
---
- name: Stage 1 — Patch test group
  hosts: patch_test
  become: true
  tasks:
    - name: Create restore point
      ansible.builtin.command: timeshift --create --comments "pre-patch"
      when: ansible_os_family == "Debian"

    - name: Apply security updates (Debian)
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == "Debian"

    - name: Apply security updates (RedHat)
      ansible.builtin.dnf:
        name: "*"
        state: latest
        security: true
      when: ansible_os_family == "RedHat"

    - name: Check if reboot required
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: reboot_flag

    - name: Reboot if required
      ansible.builtin.reboot:
        reboot_timeout: 300
      when: reboot_flag.stat.exists | default(false)
```

### Rollback Procedures

```bash
# Debian/Ubuntu — rollback specific package
apt install openssl=1.1.1k-1ubuntu1 --allow-downgrades

# RHEL/CentOS — rollback via dnf history
dnf history list
dnf history undo <transaction_id>

# Snapshot-based rollback (LVM)
lvconvert --merge /dev/vg0/snap_root

# Container rollback — revert to previous image tag
docker tag app:latest app:rollback-$(date +%Y%m%d)
docker pull app:v1.2.3-previous
docker tag app:v1.2.3-previous app:latest
```

### Patch Verification

```bash
# Verify patch applied — check package version
dpkg -l openssl | grep -E "^ii"
rpm -q openssl

# Rescan with Nessus to confirm remediation
curl -sk -X POST -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/launch"

# nuclei verification scan for specific CVE
nuclei -u https://target.example.com -tags CVE-2024-3400 -json
```

## Workflow

1. **Identify** — Correlate scan findings to available patches
2. **Test** — Deploy patches to test/canary group first
3. **Validate** — Run smoke tests and service health checks
4. **Stage** — Roll out to production in waves (10% → 50% → 100%)
5. **Verify** — Rescan patched hosts to confirm vulnerability closure
6. **Document** — Record patch evidence for compliance audit trail

## Detection

```yaml
title: Patch Management Workflow Detection
id: fb50b533-5348-46bc-89fa-fc4905f9bf30
status: experimental
description: Detects suspicious activity related to implementing patch management workflow techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*patch*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Patch installed | `dpkg -l` or `rpm -q` shows updated version |
| Service healthy | Health endpoint returns 200 post-patch |
| Vuln closed | Rescan shows finding resolved |
| Rollback tested | Rollback procedure validated in test env |
| Compliance logged | Patch timestamp recorded in CMDB/ticket |

## References

- [Ansible Patching Guide](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html)
- [NIST SP 800-40r4 — Patch Management](https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final)
- [CIS Control 7 — Continuous Vulnerability Management](https://www.cisecurity.org/controls/continuous-vulnerability-management)
