PatchMortem / Agent vs webhook

Two ways to connect. One engine behind both.

PatchMortem plugs into your existing patch tool over a webhook, or runs a lightweight agent on the endpoint. Same classifier, same audit chain — the difference is how much signal it sees and how much it can do without your tool's help.

AGENTLESS

Webhook integration

Nothing installed on your endpoints. Your existing tool — Intune, SCCM, ManageEngine, NinjaOne — sends failure events to PatchMortem over an outbound webhook. Classification and audit happen in the platform; remediation is sent back through your tool's API.

Best when you already run a patch tool (85–90% of Indian banks do) and want to be live in a day with zero endpoint changes.

AGENT

Endpoint agent

A ~15 MB signed agent on each endpoint captures failure signals straight from the system logs — Windows Event Log, yum, dpkg. Full log context means higher classification confidence and rollback that doesn't depend on a tool API.

Best when you have no existing patch tool, need automated rollback the tool API can't drive, or want the highest classification accuracy.

Capability comparison

What each model can do

Both share the same AI classifier, the same 215-pattern corpus, and the same HMAC-SHA256 audit chain. The agent sees more raw signal; agentless needs no endpoint footprint.

Capability Agentless webhook Agent endpoint
Detection
Patch failure detection✓ via tool webhook✓ direct from endpoint
Raw system log capture—✓ Event Log, yum, dpkg
Mean time to detectDepends on tool polling interval<100 ms from failure
Novel failure pattern capturePartial error code only✓ full log context
Classification
AI classification pipeline✓✓
215 known failure patterns✓✓
Classification confidenceGood (summarised payload)Higher (full log signal)
LLM fallback for novel patterns✓✓
Remediation
Automated rollback executionPartial tool API must support it✓ 60+ rollback methods
Human approval workflow✓✓
Cluster-aware rollbackPartial vSphere API only✓
Remediation sent back to tool✓ Intune, ManageEngine, Jira✓
Compliance & audit
HMAC-SHA256 audit trail✓✓
RBI IT Framework Section 4.2✓✓
Endpoint-level evidence origin— tool-level only✓ from endpoint itself
Compliance PDF export✓✓
Deployment
Software on endpointsNone~15 MB agent binary
Deployment time1 day3–5 days
Endpoint security review required—Required
Requires existing patch toolYes—
Inbound connections to endpointsNoneNone
Supported integrations
Microsoft Intune / SCCM✓✓
ManageEngine, NinjaOne✓✓
VMware vSphere✓ via vSphere API✓
ServiceNow / Jira✓✓
No existing tool (standalone)—✓

How the webhook integration works

Your patch tool already knows when a deployment fails. The webhook integration simply forwards that event. No agent, no endpoint security review, no inbound connection to anything.

  1. Event fires. Intune, SCCM, ManageEngine or NinjaOne records a failed patch and posts the event to your PatchMortem webhook endpoint.
  2. Classification. The 4-stage classifier matches the payload against 215 known failure patterns. Confidence is good on a summarised payload; the LLM fallback handles novel cases.
  3. Approval & remediation. Where your policy requires sign-off, the approval workflow runs. The remediation instruction is sent back through your tool's API — Intune, ManageEngine, Jira.
  4. Audit. Every step is written to the HMAC-SHA256 chain and is exportable for RBI Section 4.2, the same as the agent path.

The one limit worth stating plainly: agentless rollback is only as capable as your tool's API. Cluster-aware rollback is available via the vSphere API but not for every platform. Where the tool can't drive a safe rollback, PatchMortem flags it for a human rather than forcing it.

How the agent works

The agent reads failure signals directly from the endpoint's own logs, so it sees the full context a summarised webhook payload leaves out — and it can execute 60+ rollback methods without depending on a tool API.

  1. Capture. The agent watches Windows Event Log, yum and dpkg and captures the full failure signal within ~100 ms.
  2. Classification. Full log context raises classification confidence above what a summarised payload allows.
  3. Remediation. 60+ rollback methods run directly, with human approval where policy requires it and cluster-awareness built in.
  4. Audit. Evidence originates at the endpoint itself, not just the management tool — a stronger position in front of an inspector.

The agent initiates outbound connections only. There is no inbound listener and no open port on your estate — the same posture as the webhook path. Full detail is on the security page.

Which should an Indian bank start with?

Start with agentless. 85–90% of banks already run Intune, SCCM, or ManageEngine. You can be live in one day with no endpoint changes and no security review of a new binary. Move to the agent later for the estates that need standalone coverage, tool-independent rollback, or the highest classification accuracy — and run both side by side across a mixed estate.

Choose agentless whenYou already have a patch tool, want a one-day rollout, and can accept tool-API-bound rollback.
Choose the agent whenYou have no existing tool, need rollback the tool API can't drive, or want maximum classification accuracy.
Run both whenA mixed estate has some hosts covered by a tool and some standalone — one console, one audit chain.

Not sure which fits your estate?

Tell us what patch tooling you run today. We'll tell you honestly whether agentless covers you or the agent earns its place.

Talk to an engineer See how it works