Patch Management
Use this playbook when patching must be managed as an end-to-end operational process, not only as a package installation task. The solution combines asset scope, vulnerability priority, deployment controls, verification, rollback readiness, and reporting.
Solution Scope
Patch management in Cloudaware uses CMDB to define which hosts are in scope, Patch Management to discover and deploy missing packages, and Vulnerability Management to prioritize fixes based on security findings. Breeze Agent provides host-level telemetry and execution for supported patch workflows.
Use this solution when you need to:
- Patch Linux and Windows hosts across cloud and data center environments.
- Prioritize patches based on vulnerabilities, severity, exposure, and asset criticality.
- Coordinate patch waves by owner, application, environment, region, or maintenance window.
- Verify remediation and keep evidence for audit or compliance reporting.
- Support rollback planning for higher-risk patch cycles.
Module Fit
| Module or service | Role in the solution |
|---|---|
| CMDB | Defines patch scope, ownership, environment, application mapping, and host relationships. |
| Patch Management | Discovers missing packages, manages patch policies, runs jobs, verifies status, and records evidence. |
| Vulnerability Management | Prioritizes remediation based on findings, scanner coverage, SLAs, and exceptions. |
| Breeze Agent | Collects host-level package data and executes patch actions where supported. |
Workflow
-
Confirm host eligibility. Use CMDB and Patch Management coverage views to identify supported hosts, Breeze Agent status, operating system version, environment, ownership, and maintenance requirements.
-
Define patch scope. Group hosts by application, owner, environment, criticality, region, operating system, or patch group. Keep production and non-production scopes separate unless the maintenance process intentionally combines them.
-
Prioritize by risk and compliance need. Use Vulnerability Management to identify patches related to critical or exploited vulnerabilities, overdue SLAs, internet-facing systems, compliance controls, and high-criticality applications.
-
Select the patching pattern. Choose the appropriate operating pattern: recurring monthly patching, emergency security patch, kernel update, or ad-hoc patching. Use Patch Management playbooks for the detailed procedure.
-
Schedule deployment windows. Align patch waves with maintenance windows, blackout windows, reboot policy, application dependencies, and support team availability. Use canary groups before broad production rollout.
-
Execute and monitor patch jobs. Track job status, failures, skipped hosts, reboots, and timeout behavior. Route failed or blocked hosts to the responsible owner with enough CMDB context to investigate.
-
Verify remediation. Confirm package state, host health, vulnerability re-scan results, and any required compliance evidence. Keep exceptions for hosts that cannot be patched within the expected SLA.
-
Close the cycle. Review completion rate, failures, remaining vulnerabilities, exceptions, rollback events, and data quality gaps. Use the review to improve grouping, maintenance windows, and ownership data before the next cycle.
Expected Outputs
- Patch scope based on CMDB inventory, ownership, and eligibility.
- Prioritized patch queues connected to vulnerability findings and SLAs.
- Scheduled patch waves with canaries, maintenance windows, and rollback readiness.
- Patch execution and verification evidence.
- Reports for completion, exceptions, failed hosts, overdue patches, and compliance posture.