Your patch management tool reports a failure. PatchMortem takes over. No runbook. No ticket. No 2am call.
Your patch management tool reports a failure. PatchMortem takes over. No runbook. No ticket. No 2am call.
The PatchMortem agent captures failure signals from SCCM, Intune, ManageEngine, NinjaOne, or your Ansible playbook — error codes, event logs, failed components, and the raw log excerpt.
POST /api/v1/classifyA 4-stage classifier pipeline matches the signal against 215 known patch failure patterns using vector similarity search against our errata corpus. Confidence 0.95+ on first match.
CLUSTER_RESOURCE:NODE_EVICTED · 0.947Asset risk tier, compliance scope (PCI-DSS, RBI, SEBI), cluster role, and snapshot availability determine whether to auto-remediate, freeze for approval, or escalate to change board.
HIGH risk · CHANGE_BOARD requiredEvery decision is written to an HMAC-SHA256 chained audit trail. Tamper-evident, append-only. RBI inspectors can verify the chain end-to-end without accessing your systems.
HMAC-SHA256 · block 1,247 · verifiedA real incident on a Windows Failover Clustering node, from the first failure signal through to a verified audit record.
| Asset | ibk-prod-app-01.corp.local |
| Operating system | Windows Server 2022 |
| Patch | KB5034441 |
| Risk tier | HIGH · WSFC ACTIVE |
| Snapshot | Ready · 2h ago |
| Approval | CHANGE_BOARD |
| SERVICE_CRASH:PERMISSION | 80.96% Selected |
| CORRUPTED_PACKAGE:INCOMPLETE | 62.1% Alt |
| DEPENDENCY_CONFLICT:RUNTIME | 41.3% |
| HARDWARE_INCOMPATIBILITY | 12.0% |
The lsass.exe termination with CBS permission error 0x800f0922 indicates the Windows Component-Based Servicing installer failed mid-transaction during KB5034441. TrustedInstaller acquired locks on WinSxS components that were incompatible with the active WSFC node state.
Recommended action: Drain WSFC node first, restore pre-patch snapshot, verify lsass.exe stability before rejoining cluster.
| 14:32:08 | Failure detected · lsass.exe 0x800f0922 · agent signal received, WSFC ACTIVE identified |
| 14:32:50 | AI classification · SERVICE_CRASH:PERMISSION · confidence 80.96% · rollback: SNAPSHOT |
| 14:33:01 | Topology check · WSFC validated · PASSIVE node ibk-prod-app-02 confirmed healthy |
| 14:38:20 | Change board approved · four-eyes approval enforced · logged to audit chain |
| 14:40:15 | Snapshot restored · cluster rejoined · total remediation time 8m 7s |
| seq #1 | PATCH_FAILURE_DETECTED · hash 3a8f9c2e · prev 0000000000 |
| seq #2 | CLASSIFICATION_COMPLETED · hash 7d4c1b8a · prev 3a8f9c2e · confidence 0.8096 |
| seq #3 | APPROVAL_REQUESTED · hash 2e6b4a9c · prev 7d4c1b8a · tier CHANGE_BOARD |
| seq #4 | ROLLBACK_COMPLETED · hash 9f1c7d3e · prev 2e6b4a9c · method SNAPSHOT |
Chain integrity verified across all 4 records
| RBI IT Framework 2023 | PDF · ready |
| PCI DSS 6.3 | PDF · ready |
| HIPAA 164.312(b) | PDF · ready |
| SOC 2 CC7.2 | PDF · ready |
30-minute live demo on your actual patch management setup. No slides. No vendor pitch.