PatchMortem / How it works

From signal to remediation, step by step

Your patch management tool reports a failure. PatchMortem takes over. No runbook. No ticket. No 2am call.

Your patch management tool reports a failure. PatchMortem takes over. No runbook. No ticket. No 2am call.

1

Signal ingestion

The PatchMortem agent captures failure signals from SCCM, Intune, ManageEngine, NinjaOne, or your Ansible playbook — error codes, event logs, failed components, and the raw log excerpt.

POST /api/v1/classify
2

Semantic classification

A 4-stage classifier pipeline matches the signal against 215 known patch failure patterns using vector similarity search against our errata corpus. Confidence 0.95+ on first match.

CLUSTER_RESOURCE:NODE_EVICTED · 0.947
3

Risk-aware action vector

Asset risk tier, compliance scope (PCI-DSS, RBI, SEBI), cluster role, and snapshot availability determine whether to auto-remediate, freeze for approval, or escalate to change board.

HIGH risk · CHANGE_BOARD required
4

Cryptographic audit trail

Every decision is written to an HMAC-SHA256 chained audit trail. Tamper-evident, append-only. RBI inspectors can verify the chain end-to-end without accessing your systems.

HMAC-SHA256 · block 1,247 · verified

A worked example

A real incident on a Windows Failover Clustering node, from the first failure signal through to a verified audit record.

Assetibk-prod-app-01.corp.local
Operating systemWindows Server 2022
PatchKB5034441
Risk tierHIGH · WSFC ACTIVE
SnapshotReady · 2h ago
ApprovalCHANGE_BOARD

Raw signal from the Go agent

lsass.exe terminated · error 0x800f0922
patch: KB5034441 · os: Windows Server 2022
node: WSFC ACTIVE · CBS partial state detected
failed_component: TrustedInstaller · WinSxS

Vector similarity — 215 failure patterns searched

SERVICE_CRASH:PERMISSION80.96%   Selected
CORRUPTED_PACKAGE:INCOMPLETE62.1%   Alt
DEPENDENCY_CONFLICT:RUNTIME41.3%
HARDWARE_INCOMPATIBILITY12.0%

Root cause analysis

The lsass.exe termination with CBS permission error 0x800f0922 indicates the Windows Component-Based Servicing installer failed mid-transaction during KB5034441. TrustedInstaller acquired locks on WinSxS components that were incompatible with the active WSFC node state.

Recommended action: Drain WSFC node first, restore pre-patch snapshot, verify lsass.exe stability before rejoining cluster.

Remediation timeline

14:32:08Failure detected · lsass.exe 0x800f0922 · agent signal received, WSFC ACTIVE identified
14:32:50AI classification · SERVICE_CRASH:PERMISSION · confidence 80.96% · rollback: SNAPSHOT
14:33:01Topology check · WSFC validated · PASSIVE node ibk-prod-app-02 confirmed healthy
14:38:20Change board approved · four-eyes approval enforced · logged to audit chain
14:40:15Snapshot restored · cluster rejoined · total remediation time 8m 7s

Resulting audit chain

seq #1PATCH_FAILURE_DETECTED · hash 3a8f9c2e · prev 0000000000
seq #2CLASSIFICATION_COMPLETED · hash 7d4c1b8a · prev 3a8f9c2e · confidence 0.8096
seq #3APPROVAL_REQUESTED · hash 2e6b4a9c · prev 7d4c1b8a · tier CHANGE_BOARD
seq #4ROLLBACK_COMPLETED · hash 9f1c7d3e · prev 2e6b4a9c · method SNAPSHOT

Chain integrity verified across all 4 records

Available compliance exports

RBI IT Framework 2023PDF · ready
PCI DSS 6.3PDF · ready
HIPAA 164.312(b)PDF · ready
SOC 2 CC7.2PDF · ready

See it working on your environment

30-minute live demo on your actual patch management setup. No slides. No vendor pitch.