Patch failures diagnosed and
fixed automatically

PatchMortem classifies patch failure signals in milliseconds, executes the correct rollback, and writes a tamper-evident audit chain your compliance team can present to RBI — without a single ticket to your L2 team.

Start free trial Get a demo AWS Marketplace

patchmortem-agent · ibk-prod-app-01

07:42:11● PATCH FAILURE DETECTED

host:ibk-prod-app-01

patch:KB5034765

event:Event ID 1135 — node evicted

07:42:11⟶ STAGE 1 signal extraction

components: [FailoverClustering]

error_codes: [1069, 1135]

07:42:12⟶ STAGE 2 vector match (Pinecone)

match:WIN-CLUSTER-002· similarity 0.7157

class:CLUSTER_RESOURCE:NODE_EVICTED

confidence:0.9471

07:42:12⟶ STAGE 4 risk overlay

risk_tier:HIGH· action:FREEZE

rollback:CLUSTER_RESOURCE_REPAIR

approval:CHANGE_BOARD required

07:42:13✓ AUDIT RECORD WRITTEN

chain:HMAC-SHA256 · block 1,247

elapsed:1,847ms

Compliant

4/5

agent healthy

Incidents

1 pending

Patches

2 critical

Chain

INTACT

verified

Recent incidents

CLUSTER_RESOURCE · KB5034765
Critical · WSFC

openssl SONAME · RHEL 9
High · Dep conflict

Ubuntu kernel panic · resolved
Resolved

Patch risk matrix

0–7d

8–30d

31–90d

Critical

—

High

Medium

How it works

From signal to remediation in under two seconds

Your patch management tool reports a failure. PatchMortem takes over. No runbook. No ticket. No 2am call.

Signal ingestion

The PatchMortem agent captures failure signals from SCCM, Intune, ManageEngine, NinjaOne, or your Ansible playbook — error codes, event logs, failed components, and the raw log excerpt.

POST /api/v1/classify

Semantic classification

A 4-stage classifier pipeline matches the signal against 215 known patch failure patterns using vector similarity search against our errata corpus. Confidence 0.95+ on first match.

CLUSTER_RESOURCE:NODE_EVICTED · 0.947

Risk-aware action vector

Asset risk tier, compliance scope (PCI-DSS, RBI, SEBI), cluster role, and snapshot availability determine whether to auto-remediate, freeze for approval, or escalate to change board.

HIGH risk · CHANGE_BOARD required

Cryptographic audit trail

Every decision is written to an HMAC-SHA256 chained audit trail. Tamper-evident, append-only. RBI inspectors can verify the chain end-to-end without accessing your systems.

HMAC-SHA256 · block 1,247 · verified

Platform

Everything your compliance
team will ask for

AI classification

Know WHY it failed before you fix it

A 4-stage pipeline — extraction, vector match, LLM fallback, risk overlay — matches every failure against 215 known patterns across Windows, RHEL, Ubuntu, Kubernetes, VMware ESXi, SQL Server, and Oracle. Your team sees the root cause at 0.95+ confidence before the rollback starts.

4-stage classifier: extraction → vector match → LLM fallback → risk overlay
215 patterns across Windows, RHEL, Ubuntu, K8s, ESXi, SQL Server, Oracle
Confidence score shown to approvers before rollback

See how it works →

Input → KB5034441 · lsass.exe · 0x800f0922 · WSFC ACTIVE

SERVICE_CRASH:PERMISSION

80.96%

✓ Selected

CORRUPTED_PACKAGE:INCOMPLETE

62.1%

Alt

DEPENDENCY_CONFLICT:RUNTIME

41.3%

BOOT_FAILURE:BOOTLOADER

18.7%

AI root cause (Claude Sonnet)

lsass.exe CBS permission failure during KB5034441. WSFC ACTIVE node — drain before rollback. Recommend snapshot restore.

Cryptographic audit chain

Tamper-evident proof for your RBI audit

Every remediation decision, approval, and rollback is written to an append-only, HMAC-SHA256 cryptographically chained audit log — designed specifically for RBI IT Framework Section 4.2 evidence requirements. Tamper with one record and the chain breaks.

HMAC-SHA256 with key versioning
Append-only records — built for RBI IT Framework Section 4.2
One-click compliance export for RBI, PCI-DSS, SEBI, IRDAI

See compliance reports →

PATCH_FAILURE_DETECTED

hash: 3a8f9c2e · prev: 0000000000 · seq #1

CLASSIFICATION_COMPLETED · 80.96%

hash: 7d4c1b8a · prev: 3a8f9c2e · seq #2

APPROVAL_REQUESTED · CHANGE_BOARD

hash: 2e6b4a9c · prev: 7d4c1b8a · seq #3

ROLLBACK_COMPLETED · 8m 7s

hash: 9f1c7d3e · prev: 2e6b4a9c · seq #4

Chain integrity verified — tamper-evident

Compliance-aware rollback engine

The right rollback, chosen by risk — not guesswork

PatchMortem knows the difference between a dev box and a PCI-DSS-scoped production cluster. It executes SNAPSHOT restore, PACKAGE_UNINSTALL, CLUSTER_RESOURCE_REPAIR, KERNEL_ROLLBACK and 60+ other rollback methods based on what the classifier determines — not what your L2 engineer guesses.

60+ rollback methods, auto-selected by compliance scope
Approval tiers adjust automatically for PCI-DSS / RBI / SEBI scope
Predictive intelligence flags high-risk patch windows pre-emptively

See how rollback works →

Remediation timeline — ibk-prod-app-01

Failure detected · lsass.exe 0x800f0922

Agent signal received · WSFC ACTIVE identified