Articles in this section

See more

Introduction to Patching Strategies

Avatar
Tom Gibson
  • Updated
Follow

Creating a Patching Strategy is a great way to get started using . Start with a common scenario, and then build a Patching Strategy to distribute a patch to active clients.

Patching Strategy Use Case

An administrator wants to build a Patching Strategy to update devices every day based on devices that have the following characteristics:

  • Company wide (all Clients).

  • Within a Falcon Host Group Business Unit.

  • Running a version of Google Chrome Enterprise other than the internally approved version.

  • Initial approval needed.

  • Immediate, mandatory update to approved version.

Open and Save a Patching Strategy Template

  1. Follow the instructions in Create a New Folder for Objects.

  2. Hover over or click Strategy in the left navigation menu of the Adaptiva OneSite Patch Dashboard, and then select Patching Strategies.

  3. Select Show All to see all available Patching Strategies. This populates the Patching Strategies table with the available templates.

    OSP-Ent-PS-ChooseStrategy.png

    For descriptions of each template type, see Patching Strategy Templates.

  4. Enter the Name of an existing strategy on the Search bar, and then click Search.

  5. Select the Name of the strategy to open it.

  6. Select More in the upper left corner of the template, and then select Save Patching Strategy As:

    OSP-Ent-PS-SaveStrategyAs.png

    1. Enter a unique name that reflects what the strategy does conceptually. For example, ITS Immediate Daily Product Patching.

    2. Select OK. This opens your strategy template with all the default entries for the built-in strategy, including a detailed description.

    3. Enter a detailed Description of your new template or keep the existing detail, and then click Save on the upper-left corner of the dialog.

Tip

Remember to click Save on the upper left corner to save your progress. After completing the Patching Strategy configuration, you must save and enable the completed strategy to make it available for use.

Configure Deployment Settings

Deployment Settings for quick start purposes include selecting a built-in Deployment Wave, which already includes a Business Unit. For details on Deployment Waves, see Deployment Waves. When customizing an existing template, process and deployment fields may include tables with existing configuration selections.

OSP-Ent-PS-DepSettings.png

Add a Deployment Wave

  1. Scroll down to Deployment Settings in an open Patching Strategy template.

  2. Select Browse next to Add Deployment Wave.

    OSP-Ent-PS-Browse4DW.png

    This opens the Add Deployment Wave dialog.

    OSP-Ent-PS-SelectDepWave.png

  3. Select Single Wave – All Clients.

    This Deployment Wave includes a Business Unit called All Clients Business Unit. For information about Business Units, see Business Units and Rollout Processes.

  4. Select Add Deployment Wave on the bottom-left corner of the dialog.

    • This returns you to the object template.

    • There is no need to modify the Deployment Bot Runtime settings for purposes of this exercise, but it is an important part of a Patching Strategy template. Be sure to review the Deployment Bot Runtime settings when you are creating your own Patching Strategies (see Deployment Bot Runtime Settings).

Trigger Metadata Properties

These properties allow administrators to enable automatic reevaluation of previously presented patches and software when patch metadata properties change. These settings allow OneSite to respond to changes in CrowdStrike Falcon metadata, particularly to the intelligence based EXPRT ratings.

All metadata objects have explicit properties, so if a Parent Business Unit has a property that a related child does not explicitly set, the child implicitly inherits the property. As a result, a change to the parent child might or might not result in a difference on the child.

When detects a change in a patch EXPRT rating, the Trigger Metadata Properties define whether to resubmit an already-routed patch based on the EXPRT rating change. For example, if a previously submitted, low vulnerability patch on a monthly update cycle becomes a critical vulnerability, and the Trigger Metadata Properties include an EXPRT setting, patch resubmits the patch to the critical exposure level patching cycle, which likely follows a more frequent schedule.

Using Trigger Metadata Properties

Set CrowdStrike Trigger Metadata Properties as part of creating a Patching Strategy.

When added to a Patching Strategy, the defined Trigger Properties prompt OneSite to resubmit an installable when a metadata property of the installable has been added, removed, or modified by either Adaptivaor CrowdStrike Falcon.

For example, with the Falcon.ExPRT trigger selected, when the ExPRT rating of a low vulnerability patch changes to a critical ExPRT rating, resubmits the now-critical patch, and resets the schedule to match the settings for the critical rating.

These changes occur when each of the following conditions are true:

  • Patching Strategy includes the related product.

  • Installable previously submitted to the Patching Strategy.

  • Installable applies to at least one device in the strategy.

Manage Trigger Metadata Properties

Adaptiva provides several Trigger Metadata Properties, including properties specific to Adaptiva, CrowdStrike Falcon Spotlight, and Windows Defender Antivirus.

View All Trigger Metadata Properties

  1. Scroll down to Trigger Metadata Properties in an open Patching Strategy template.

  2. Select + Select to open the Select Trigger Properties dialog.

Select from all Trigger Properties

The first table you see shows all available trigger properties. The list includes Adaptiva, CrowdStrike Falcon Spotlight (if licensed), and Windows Defender Antivirus Patching properties.

  1. In the Select Trigger Properties table of the Trigger Metadata Properties dialog, select one or more properties to use as triggers:

    • To find a specific trigger, enter a trigger name on the Search line, and then select Search.

    • To sort the list of Trigger Properties, click Property to reverse the alphabetical support order.

    • To page through the available trigger properties, use the navigation tools on the bottom-right of the dialog.

    OSP-Ent-PS-AdaptivaTriggerSections.png

  2. Select OK on the bottom-left corner of the dialog to save your selections and return to the Patching Strategy template.

Select Only CrowdStrike Falcon Trigger Properties

In the Select Trigger Properties table of the Trigger Metadata Properties dialog, enable a view of CrowdStrike Falcon properties only.

  1. Select the CrowdStrike Properties toggle to enable or disable (default) a view of Falcon properties only.

  2. Select one or more Falcon properties from the table.

    OSP-Ent-PS-TriggerCRWD.png

  3. Select OK at the bottom left of the dialog to save your selections and return to the Patching Strategy template.

Select Only Windows Defender Antivirus Trigger Properties

  1. Select the Windows Defender Antivirus Patching Properties toggle under Integration Filters in the Select Trigger Properties dialog.

  2. Select a Windows Defender property from the table.

    OSP-Ent-PS-TriggerDefender.png

  3. Select OK at the bottom left of the dialog to save your selections and return to the Patching Strategy template.

    OSP-Ent-PS-TriggerMetadata.png

Remove Trigger Metadata Properties

  1. Scroll down to Trigger Metadata Properties in an open Patching Strategy template. If the Patching Strategy includes Trigger Metadata Properties, the table under +Select lists those properties.

  2. Select the ellipsis (…) under Actions for the trigger you want to remove, and then select Remove.

    OSP-Ent-PS-TriggerRemove.png

  3. Select Save on the upper-left corner of the Patching Strategy to save your changes.

Add Software Products

For this exercise, we will add one product using the Products workspace near the top of an open Patching Strategy template.

  1. Select + Add Software Products in the Products workspace of an open Patching Strategy template.

    OSP-Ent-PS-AddSWProducts.png

  2. Select the Down Arrow next to Search Columns and verify that the only box checked is next to Name.

    OSP-Ent-PS-SetSearchField.png

  3. Enter Chrome on the search line, and then click Search.

    OSP-Ent-PS-SearchSWProducts.png

  4. Select Google Chrome x64, and then click Add Software Products on the lower-left corner of the dialog.

    OSP-Ent-PS-SelectAndAddSWProducts.png

  5. Scroll up to General Settings to enable the strategy.

Enable the Patching Strategy

After completing the Patching Strategy configuration, including Add Software Products, you must enable the Patching Strategy. When enabled, the strategy runs according to the configured schedules.

  1. In General Settings at the top of the Patching Strategy template, click the Strategy Enabled toggle to enable the strategy and make it available for use.

    OSP-Ent-PS-enableandsave.png

  2. Select Save on the upper-left corner of the workflow to save the strategy:

    1. Check the Error View and resolve any errors.

    2. Select Save again if you make any changes.

  3. Move the saved template to your folder.

View the Staged Patching Strategy

After you Enable the Patching Strategy, you can view the pending approval request.

  1. Select the Approval Requests in the left navigation menu of the OneSite Patch Dashboard.

    OSP-Ent-PS-approvalrequest.png

    • The view defaults to All requests, which includes pending and completed.

    • The Patching Strategy you just enabled appears in the Approval Summary table with a Request Status of In Progress and Awaiting Response.

  2. Select Flex Controls > Patching Cycles from the left navigation menu of the OneSite Patch Dashboard.

    OSP-Ent-PC-FXCmenu-PatchCycles.png

  3. Check the Running Patch Processes table, which lists the status of the Patching Strategy as Waiting.

    OSP-Ent-PDB-processwaiting.png

  4. Select Approval Requests in the left navigation menu, and then click the Patching Strategy in the table.

  5. Select Approve, and then click Back to Approval Requests. You can wait until the patch time passes, or you can start the deployment manually.

Important

When you add a new device (Adaptiva Server) to your network after this strategy has scanned and updated all associated devices, automatically adds any new devices to the strategy if the next scan detects an earlier version of Chrome.

Start the Patching Strategy Manually

After the Patching Strategy approval process status shows Completed, you can wait until the time setting for patch deployment, or you can start the deployment immediately.

  1. Select Flex Controls > Patching Cycles, and then click the name of the Patching Strategy to open the Cycle Information.

    OSP-Ent-PDB-processwaiting.png

  2. Select Play OSP-Ent-PDb-playicon.png under Cycle Information, and then click Close. This returns you to the Patching Cycles workspace where you can view Running Patch Processes.

    OSP-Ent-PS-InProgress.png

  3. Select the Patching Strategy name to view details about the patching process.

Optional Objects in Patching Strategy Templates

The exercise in Introduction to Patching Strategies uses the minimum requirements for a Patching Strategy.

Additional settings in the Patching Strategy template include those listed below, though you do not need them for quick start purposes. Configuration steps for each are documented as part of Creating a Patching Strategy.
OSP-Ent-PSDCBU-advobjects.png

Related articles

Comments

0 comments

Article is closed for comments.