Patch Intelligence

Ivanti Cloud delivers a Patch Intelligence application that gathers and aggregates data to help manage, prioritize and streamline patching in your environment.

Known issues reported by customers or Ivanti can be used to highlight potential problems with individual patches.

You can filter and sort the patches by severity, which gives you a priority order to apply patches that resolve the largest problems first—for example, Security Critical and Security Important. You can also use bulletin and patch threat scores to help with the prioritization.

Not only is Patch Intelligence a proactive tool used by IT Ops teams to plan the deployment of patches, it can also be used reactively. For example, technical support investigating an issue can check the reliability ratings and feedback for recently applied patches that may be pertinent to the issue they're investigating.

To access Patch Intelligence, click Software > Patch Intelligence in the left navigation pane.

Watch a video.

Getting to know Patch Intelligence (4:58)

Add a Connector

To add an Ivanti Endpoint Manager (EPM), Security Controls, or Patch for SCCM connector, select Add Connector at the top of the dashboard, the Help panel Get Started with Connectors slides out, select Go To Connectors which walks you through the steps required.

Alternatively:

  1. Open the Setup menu.
  2. Select Connectors. See the Setting up connectors topic for further details.
  3. Select Add Connector for the desired server.
    The connector tiles display.
  4. Select the required connector tile.
    The connector form displays. For more information on how to complete the form see the relevant connector Help topic.

All Bulletins

Once a connector has been added the Patch Intelligence dashboard displays all the devices in the connected environment, called My Environment. To switch the view back to display all released bulletins, select All Bulletins.

Dashboard pie charts

The Patch Intelligence dashboard contains 3 charts; you can click any colored segment on a chart to filter the results in the bulletin table below the charts. To remove any applied filters, click the clear filters icon.

The chart types are:

  • Top Vendors: The top 5 vendors that have released the most bulletins within the last 14 days.
  • Bulletin Types: The number of each type of bulletin across all vendors released within the last 14 days.
  • MS Patch Tuesday: All of the Microsoft Patch Tuesday bulletins, categorized by vendor and severity. This chart also includes Third Party vendors which have at least one CVE associated with an MS bulletin.

Why 14 Days? - Research has shown that patching vulnerabilities within 14 days of identification is the optimum period to reduce risk of exploitation.

  • Devices Exceeding SLA: This chart replaces the Top Vendors chart if you have My Environment selected. It allows you to easily see how many devices within your environment are nearing or exceeding your service level agreement (SLA). Click on a number in the chart to filter the bulletin table, and hover over a number to see how many bulletins have been identified as missing from the devices.
    This chart is configurable, click the ellipsis to open the chart settings. The data can easily be exported in CSV format, see the To export section for details on what gets exported.
    • Title and Description: The title and the description for the chart can be customized, up to a limit of 60 characters.
    • Bulletin type: The default for the chart is to include all bulletin types, but you can select to only include specific bulletin types based on security severity. For example, select Security Critical to only show the number of devices nearing or exceeding your SLA that are missing security critical patches.
    • Your SLA limit: Set the number of days for your SLA. This can be between 1 - 365.
    • Your SLA threshold: Set the number of days for your SLA threshold. This is the number of days before the actual SLA limit that you want to be notified about, it can be between 0 - 365, but not higher than the SLA value.

You must have permissions to edit the SLA settings, to assign permissions to a role navigate to Setup > Roles > Permissions > Patch Intelligence > Edit SLA Config.

Bulletins

The bulletin table contains a list of all the latest validated bulletins with associated patches, listed in date order by default. You can customize the view by filtering, sorting, or searching by keyword (see below).

You can customize the table view using the Column Chooser . Available columns are:

  • Reliability: Helps to determine the stability of the patch. Patch Intelligence gathers data from a variety of sources to provide a confidence score for updates to supplement your patch testing efforts. It is derived from the number of successful and failed installs, with other stability metrics, like vendor and user reported known issues, to categorize the patch into one of the following:
    • Green: Excellent - this represents patches that have a 100% install success rate

    • Green: Very High

    • Green: High

    • Amber: Good

    • Amber: Medium

    • Amber: Low

    • Red: Very Low

    • Grey: n/a - too few installation attempts to categorize

  • Threat: Highest NVD (National Vulnerability Database) CVSS (Common Vulnerability Scoring System) v3 score taken from all CVEs associated with patches in the bulletin. If v3 is not available the v2 score is taken. N/A displays if no score is available.
    • Green indicates a score of 0.1 - 3.9
    • Yellow indicates a score of 4.0 - 6.9
    • Red indicates a score of 7.0 - 10

NIST (National Institute of Standards and Technology) can take up to 2 weeks to update their website.

  • Bulletin Id: Click to open the Bulletin Information.
  • Title: Click to open the Bulletin Information.
  • Known Issues: Number of reported known issues. Click to open the Known Issues tab on the Bulletin Information.
  • Unpatched Devices: Number of devices that do not have the patch installed. Click to open the Unpatched Devices tab on the Bulletin Information.
    The Unpatched Devices column is only available when a connector is added.
  • Bulletin Date: The bulletin's date of issue.
  • CVE Count: Number of CVEs the bulletin contains.
  • Vendor: Software vendor that has issued the bulletin.
  • Type : The bulletins are categorized to one of the following types:
    • Security: Critical, Important, Moderate, Low, Unassigned
    • Non-Security: Critical, Important, Moderate, Low, Unassigned

Filter, Sort, Search and Export

You can search, sort, and filter the bulletin database based on a number of attributes.

Bulletin Information

Click a bulletin in the table to view further details, such as vendor security, threat score, known issues and products affected.

Related topics

Viewing the Devices list

Setting up connectors

Ivanti Endpoint Manager connector

Ivanti Security Controls connector

Ivanti Patch for SCCM connector