菜单
Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates within risk-based remediation SLAs.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
SOC 2 Type II audit preparation involves designing, implementing, and demonstrating the operational effectiveness of controls aligned to the AICPA Trust Services Criteria (TSC) over a defined audit pe
UI/UX best practices for web interfaces. Use when reviewing animations, CSS, audio, typography, UX patterns, prefetching, or icon implementations. Covers 11 categories from animation principles to typography. Outputs file:line findings.
Configure AWS Verified Access to provide VPN-less zero trust network access to internal applications using identity and device posture verification with Cedar policy language.
Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.
Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
| name | building-patch-tuesday-response-process |
| description | Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates within risk-based remediation SLAs. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["patch-management","patch-tuesday","microsoft","wsus","sccm","vulnerability-remediation","windows-update"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
Microsoft releases security updates on the second Tuesday of each month ("Patch Tuesday"), addressing vulnerabilities across Windows, Office, Exchange, SQL Server, Azure services, and other products. In 2025, Microsoft patched over 1,129 vulnerabilities across the year -- an 11.9% increase from 2024 -- making a structured response process critical. The leading risk types include elevation of privilege (49%), remote code execution (34%), and information disclosure (7%). This skill covers building a repeatable Patch Tuesday response workflow from initial advisory review through testing, deployment, and validation.
| Day | Activity | Owner |
|---|---|---|
| T+0 (Tuesday 10 AM PT) | Microsoft releases patches and advisories | Microsoft |
| T+0 (Tuesday afternoon) | Security team reviews advisories and triages | Security Ops |
| T+1 (Wednesday) | Qualys/vendor scan signatures updated | VM Platform |
| T+1-T+2 | Emergency patches deployed for zero-days | IT Operations |
| T+2-T+5 | Test patches in staging environment | QA/IT Ops |
| T+5-T+7 | Deploy to Pilot group (5-10% of fleet) | IT Operations |
| T+7-T+14 | Deploy to Production Ring 1 (servers) | IT Operations |
| T+14-T+21 | Deploy to Production Ring 2 (workstations) | IT Operations |
| T+21-T+30 | Validation scanning and compliance reporting | Security Ops |
| Category | Criteria | Response SLA |
|---|---|---|
| Zero-Day / Exploited | Active exploitation confirmed, CISA KEV listed | 24-48 hours |
| Critical RCE | CVSS >= 9.0, remote code execution, no auth required | 3-5 days |
| Critical with Exploit | Public exploit code or EPSS > 0.7 | 7 days |
| High Severity | CVSS 7.0-8.9, privilege escalation | 14 days |
| Medium Severity | CVSS 4.0-6.9 | 30 days |
| Low / Informational | CVSS < 4.0, defense-in-depth | Next maintenance window |
| Category | Products | Risk Level |
|---|---|---|
| Windows OS | Windows 10, 11, Server 2016-2025 | Critical |
| Exchange Server | Exchange 2016, 2019, Online | Critical |
| SQL Server | SQL 2016-2022 | High |
| Office Suite | Microsoft 365, Office 2019-2024 | High |
| .NET Framework | .NET 4.x, .NET 6-9 | Medium |
| Azure Services | Azure AD, Entra ID, Azure Stack | High |
| Edge/Browser | Edge Chromium, IE mode | Medium |
| Development Tools | Visual Studio, VS Code | Low |
Preparation Checklist:
[ ] Confirm WSUS/SCCM sync schedules are active
[ ] Verify test environment is available and current
[ ] Review outstanding patches from previous month
[ ] Confirm monitoring dashboards are operational
[ ] Pre-stage communication templates
[ ] Ensure rollback procedures are documented
[ ] Verify backup jobs ran successfully on critical servers
Triage Process:
1. Monitor MSRC Update Guide (https://msrc.microsoft.com/update-guide)
2. Review Microsoft Security Blog for advisory summaries
3. Cross-reference with CISA KEV additions (same day)
4. Check vendor advisories (Qualys, Rapid7, CrowdStrike analysis)
5. Identify zero-day and actively exploited vulnerabilities
6. Classify each CVE by severity and applicability
7. Determine deployment rings and timeline for each patch
8. Submit emergency change request for zero-day patches
9. Communicate triage results to IT Operations and management
# Post-Patch-Tuesday scan workflow
def run_patch_tuesday_scan(scanner_api, target_groups):
"""Trigger vulnerability scans after Patch Tuesday updates."""
for group in target_groups:
print(f"[*] Scanning {group['name']}...")
scan_id = scanner_api.launch_scan(
target=group["targets"],
template="patch-tuesday-focused",
credentials=group["creds"]
)
print(f" Scan launched: {scan_id}")
# Wait for scan completion, then generate report
results = scanner_api.get_scan_results(scan_id)
missing_patches = [r for r in results if r["status"] == "missing"]
# Categorize by Patch Tuesday release
current_month = [p for p in missing_patches
if p["vendor_advisory_date"] >= patch_tuesday_date]
return {
"total_missing": len(missing_patches),
"current_month": len(current_month),
"zero_day": [p for p in current_month if p.get("actively_exploited")],
"critical": [p for p in current_month if p["cvss"] >= 9.0],
}
Ring 0 - Emergency (0-48 hours):
Scope: Zero-day and actively exploited CVEs only
Method: Manual or targeted push (SCCM expedite)
Targets: Internet-facing servers, critical infrastructure
Approval: Emergency change, verbal CISO approval
Rollback: Immediate rollback if service degradation
Ring 1 - Pilot (Day 2-7):
Scope: All critical and high patches
Method: WSUS/SCCM automatic deployment
Targets: IT department machines, test group (5-10%)
Approval: Standard change with CAB notification
Monitoring: 48-hour soak period, check for BSOD, app crashes
Ring 2 - Production Servers (Day 7-14):
Scope: All security patches
Method: SCCM maintenance windows (off-hours)
Targets: Production servers by tier
Approval: Standard change with CAB approval
Monitoring: Application health checks, performance baseline
Ring 3 - Workstations (Day 14-21):
Scope: All security patches + quality updates
Method: Windows Update for Business / Intune
Targets: All managed workstations
Approval: Pre-approved standard change
Monitoring: Help desk ticket monitoring for issues
Ring 4 - Stragglers (Day 21-30):
Scope: Catch remaining unpatched systems
Method: Forced deployment with restart
Targets: Systems that missed prior rings
Approval: Compliance-driven enforcement
Post-Deployment Validation:
1. Re-scan environment with updated vulnerability signatures
2. Compare pre-patch and post-patch scan results
3. Calculate patch compliance rate per ring and department
4. Identify failed patches and investigate root causes
5. Generate compliance report for management review
6. Update risk register with residual unpatched vulnerabilities
7. Document exceptions and compensating controls