<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Patch Management Automation — API Reference

## Ansible Modules

```yaml
# yum — RHEL/CentOS patching
- ansible.builtin.yum:
    name: "*"
    state: latest
    security: true

# apt — Debian/Ubuntu patching
- ansible.builtin.apt:
    upgrade: safe
    update_cache: true

# win_updates — Windows patching
- ansible.windows.win_updates:
    category_names:
      - SecurityUpdates
      - CriticalUpdates
    state: installed
    reboot: true
```

## AWS Systems Manager

```bash
# Create patch baseline
aws ssm create-patch-baseline --name "SecurityPatches" \
  --approval-rules '{"PatchRules":[{"PatchFilterGroup":{"PatchFilters":[{"Key":"CLASSIFICATION","Values":["SecurityUpdates"]}]},"ApproveAfterDays":0}]}'

# Scan for missing patches
aws ssm send-command --document-name "AWS-RunPatchBaseline" \
  --targets "Key=tag:PatchGroup,Values=Production" \
  --parameters '{"Operation":["Scan"]}'

# Install patches
aws ssm send-command --document-name "AWS-RunPatchBaseline" \
  --targets "Key=tag:PatchGroup,Values=Production" \
  --parameters '{"Operation":["Install"]}'

# Check compliance
aws ssm list-compliance-summaries --filters "Key=ComplianceType,Values=Patch"

# Get patch compliance per instance
aws ssm describe-instance-patch-states --instance-ids i-1234567890abcdef0
```

## WSUS PowerShell

```powershell
# Get WSUS server
$wsus = Get-WsusServer -Name "wsus.internal" -PortNumber 8530

# Approve security updates
Get-WsusUpdate -UpdateServer $wsus -Classification SecurityUpdates -Status FailedOrNeeded |
  Approve-WsusUpdate -Action Install -TargetGroupName "Production"

# Check compliance
Get-WsusComputer -UpdateServer $wsus | ForEach-Object {
    $_.GetUpdateInstallationSummary()
}
```

## Key Metrics

| Metric | Description | Target |
|--------|-------------|--------|
| Patch compliance rate | % hosts with all patches applied | >95% |
| Mean time to patch | Average days from release to deployment | <7 days (critical) |
| Patch failure rate | % deployments requiring rollback | <5% |
| Reboot compliance | % hosts rebooted after patch | 100% |
