Docs

Appearance

Patch Management Procedure ​

Overview ​

Patch management covers OS security updates, application updates, and firewall content updates across all managed systems. HIPAA §164.308(a)(5)(ii)(B) requires a patch management process. This document defines what gets patched, when, and how to verify it.

Owner: Rory (coordinates with Kevin and Greg for domain-joined servers)

Scope ​

System TypePatch MethodCadence
Windows endpoints (staff laptops/desktops)Intune Update RingsMonthly (Patch Tuesday +7 days)
Windows servers (domain-joined, Azure VMs)Azure Update Manager + GPO WSUSMonthly (Patch Tuesday +14 days)
Linux VMs (Azure and AWS)unattended-upgrades + manual scheduleWeekly auto security, monthly full
Palo Alto firewallsPanorama content updatesWeekly (App-ID/threat content); quarterly (PAN-OS)
Container images (bedrock-soc agents)Dockerfile base image rebuildMonthly or on critical CVE
Azure platform servicesMicrosoft-managedAutomatic — no action needed

Windows Endpoints (Intune) ​

Update Ring Configuration ​

Three update rings are configured in Intune to stagger deployment and catch bad patches before they hit all machines:

RingMachinesQuality Update DeferralFeature Update Deferral
PreviewRory's machine0 days0 days
PilotSelected early adopters3 days30 days
BroadAll remaining staff7 days90 days

Quality updates (security patches) are mandatory — no opt-out. Feature updates (Windows version upgrades) are deferred longer to allow compatibility validation.

Checking Patch Status ​

Intune Admin Center → Devices → Monitor → Windows 10 update rings

Shows per-ring compliance: how many devices are current, pending, or failed.

Intune Admin Center → Reports → Windows updates → Windows feature update report Shows which devices haven't updated and why.

Forcing an Immediate Update ​

For a critical out-of-band patch (zero-day, actively exploited):

  1. Intune Admin Center → Devices → All devices → [device] → Sync — forces the device to check in and pick up policy immediately
  2. Or via PowerShell (Remotely via Intune Live Shell):
    powershell
    # Force Windows Update check
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()

For emergency patches, you can temporarily reduce the Broad ring deferral to 0 days, then restore it after patching is complete.

Failed Patch Investigation ​

Intune → Devices → [device] → Device compliance → Updates

Common failure reasons:

  • Device was offline during the update window — will patch on next check-in
  • Pending restart — user hasn't rebooted after a previous patch
  • Insufficient disk space — clean up C:\Windows\Temp or system drive
  • Driver conflict — check Windows Update error code in Event Viewer → System log

Windows Servers (Domain-Joined Azure VMs) ​

Patching Schedule ​

Servers are patched on the second Tuesday + 14 days (approximately the 4th week of the month) — two weeks after Patch Tuesday gives time for the broader IT community to surface regressions.

Kevin and Greg coordinate server patching for domain controllers.

Azure Update Manager ​

For Azure-hosted Windows VMs, use Azure Update Manager for visibility and scheduling:

Azure Portal → Update Manager → Machines → filter to subscription → view update status

Each VM shows: last assessment time, pending updates by severity (Critical, Security, Other).

Schedule updates: Update Manager → Schedule updates → New maintenance configuration

  • Set to run in the 4th week of the month
  • Set maximum maintenance duration: 2 hours
  • Reboot setting: Reboot if required

Domain Controllers — Special Care ​

Patch DCs one at a time. Never patch all DCs simultaneously — a bad patch that causes a boot failure would take down authentication for the entire domain.

Order of operations:

  1. Check AD replication health before patching: repadmin /replsummary
  2. Patch the RODC first (least impact if it fails)
  3. Verify RODC is healthy after reboot
  4. Patch the DR DC (CGIRDPAZP01 in AWS)
  5. Verify replication from primary to DR DC
  6. Patch the Primary DC last
  7. Verify all FSMO roles are back on the Primary DC after reboot: netdom query fsmo

Allow 30 minutes between each DC patch to confirm replication is healthy.

Verification After Server Patching ​

powershell
# List recently installed updates on a server
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Check Windows Update event log for failures
Get-WinEvent -LogName System | Where-Object { $_.Id -in 19, 20, 21 } | Select-Object -First 5
# Event 19 = update downloaded, 20 = installed, 21 = failed

Linux VMs ​

Automatic Security Updates (unattended-upgrades) ​

All Linux VMs in Azure and AWS run unattended-upgrades configured for security-only automatic updates. Configuration: /etc/apt/apt.conf.d/50unattended-upgrades

Security packages from ubuntu-focal-security (or equivalent) are installed automatically within 24 hours of release.

Verify the service is running on a VM:

bash
systemctl status unattended-upgrades

Check the log:

bash
cat /var/log/unattended-upgrades/unattended-upgrades.log | tail -50

Monthly Full Update ​

On the last Sunday of each month, apply all pending updates (not just security):

bash
sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

Reboot if the kernel was updated:

bash
if [ -f /var/run/reboot-required ]; then echo "Reboot required"; fi

For the secops Container Apps jobs (Linux-based), the container images are rebuilt monthly — rebuilding picks up OS updates in the base image.

Palo Alto Firewalls ​

Content Updates (Weekly) ​

Palo Alto content updates include threat intelligence, App-ID signatures, and URL category updates. These are low-risk and should be applied weekly.

Panorama → Device → Dynamic Updates

Set to check and install automatically:

  • Applications and Threats: every 24 hours
  • Antivirus: every 24 hours
  • WildFire: every 1 minute (real-time)
  • URL Filtering: daily

Or trigger manually: Panorama → Device → Dynamic Updates → Check Now → install the latest

PAN-OS Updates (Quarterly) ​

PAN-OS (the firewall OS) updates are higher risk and require a maintenance window.

Frequency: Quarterly, or when a critical CVE is published for PAN-OS.

Procedure:

  1. Read the PAN-OS release notes — check for known issues and migration steps
  2. Open a maintenance window in SecOps (suppress alerts during patching window)
  3. Upgrade RODC firewall first — if it fails, primary is unaffected
  4. After RODC firewall validates for 24 hours, upgrade Primary DC firewall
  5. Verify Panorama can still reach all managed firewalls after each upgrade
  6. Check threat logs and traffic logs are flowing correctly post-upgrade

Panorama itself must also be upgraded — always upgrade Panorama before the firewalls. Panorama must be on the same or higher version than the managed devices.

For the full upgrade procedure see Panorama Operations.

Container Images (bedrock-soc) ​

Container images are rebuilt monthly to pick up OS security patches in the base image. A code change that touches Dockerfile, app/, or alembic/ triggers an automatic rebuild via CI/CD. For months with no code changes, trigger a manual rebuild:

  1. GitHub → bedrock-soc → Actions → Deploy → Run workflow → branch: main

The Dockerfile should use a pinned but periodically updated base image:

dockerfile
FROM python:3.12-slim  # Update the minor version monthly

When a critical CVE affects the base image (e.g., glibc or openssl vulnerability), rebuild immediately regardless of schedule.

Emergency Patching (Critical CVEs) ​

For actively exploited vulnerabilities or critical CVEs with CVSS 9.0+:

  1. Assess scope — which systems are affected?
  2. Patch within 24 hours for internet-facing or critical systems
  3. Patch within 72 hours for internal systems
  4. For Windows endpoints: reduce Intune ring deferral to 0 and force sync
  5. For servers: schedule emergency maintenance window, patch outside normal cycle
  6. Create a CM ticket in SecOps before patching to suppress false-positive alerts
  7. After patching, restore normal ring deferral settings
  8. Document in the monthly security review

Patch Compliance Reporting ​

The monthly security review includes a patch compliance summary. Pull it from:

  • Intune: Devices → Monitor → Windows 10 update rings → compliance %
  • Azure Update Manager: Update Manager → Overview → pending updates count
  • Palo Alto content: Panorama → Device → Dynamic Updates → last installed date

A machine more than 30 days behind on security patches is non-compliant. Open a finding in SecOps and track remediation.

Document History ​

DateChangeAuthor
May 2026Initial draft — Windows endpoints (Intune rings), Windows servers (Azure Update Manager + DC patching order), Linux (unattended-upgrades), Palo Alto (content + PAN-OS), containers, emergency patching.Rory

Internal use only — Cirius Group