菜单
Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates within risk-based remediation SLAs. Use when working with building patch tuesday response process.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill building-patch-tuesday-response-process命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | building-patch-tuesday-response-process |
| description | Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates within risk-based remediation SLAs. Use when working with building patch tuesday response process. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["patch-management","patch-tuesday","microsoft","wsus","sccm","vulnerability-remediation","windows-update"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
Microsoft releases security updates on the second Tuesday of each month ("Patch Tuesday"), addressing vulnerabilities across Windows, Office, Exchange, SQL Server, Azure services, and other products. In 2025, Microsoft patched over 1,129 vulnerabilities across the year -- an 11.9% increase from 2024 -- making a structured response process critical. The leading risk types include elevation of privilege (49%), remote code execution (34%), and information disclosure (7%). This skill covers building a repeatable Patch Tuesday response workflow from initial advisory review through testing, deployment, and validation.
| Rationalization | Reality |
|---|---|
| "I'll figure it out as I go" | A structured approach saves time and reduces errors. Follow the workflow in this skill rather than improvising. |
| "I already know this topic" | Familiarity breeds shortcuts. Use the checklist to verify you haven't missed critical steps. |
| "This doesn't apply to my situation" | The patterns here generalize across contexts. Adapt, don't skip — the underlying principles hold. |
| "One more tool will fix it" | Adding complexity rarely solves process gaps. Master the core workflow first. |
Trigger phrases:
"building patch tuesday response process"
"Establish a structured operational process to triage, test, and deploy Microsoft"
When deploying or configuring building patch tuesday response process capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
This section covers core concepts for building patch tuesday response process.
| Day | Activity | Owner |
|---|---|---|
| T+0 (Tuesday 10 AM PT) | Microsoft releases patches and advisories | Microsoft |
| T+0 (Tuesday afternoon) | Security team reviews advisories and triages | Security Ops |
| T+1 (Wednesday) | Qualys/vendor scan signatures updated | VM Platform |
| T+1-T+2 | Emergency patches deployed for zero-days | IT Operations |
| T+2-T+5 | Test patches in staging environment | QA/IT Ops |
| T+5-T+7 | Deploy to Pilot group (5-10% of fleet) | IT Operations |
| T+7-T+14 | Deploy to Production Ring 1 (servers) | IT Operations |
| T+14-T+21 | Deploy to Production Ring 2 (workstations) | IT Operations |
| T+21-T+30 | Validation scanning and compliance reporting | Security Ops |
| Category | Criteria | Response SLA |
|---|---|---|
| Zero-Day / Exploited | Active exploitation confirmed, CISA KEV listed | 24-48 hours |
| Critical RCE | CVSS >= 9.0, remote code execution, no auth required | 3-5 days |
| Critical with Exploit | Public exploit code or EPSS > 0.7 | 7 days |
| High Severity | CVSS 7.0-8.9, privilege escalation | 14 days |
| Medium Severity | CVSS 4.0-6.9 | 30 days |
| Low / Informational | CVSS < 4.0, defense-in-depth | Next maintenance window |
| Category | Products | Risk Level |
|---|---|---|
| Windows OS | Windows 10, 11, Server 2016-2025 | Critical |
| Exchange Server | Exchange 2016, 2019, Online | Critical |
| SQL Server | SQL 2016-2022 | High |
| Office Suite | Microsoft 365, Office 2019-2024 | High |
| .NET Framework | .NET 4.x, .NET 6-9 | Medium |
| Azure Services | Azure AD, Entra ID, Azure Stack | High |
| Edge/Browser | Edge Chromium, IE mode | Medium |
| Development Tools | Visual Studio, VS Code | Low |
Preparation Checklist:
[ ] Confirm WSUS/SCCM sync schedules are active
[ ] Verify test environment is available and current
[ ] Review outstanding patches from previous month
[ ] Confirm monitoring dashboards are operational
[ ] Pre-stage communication templates
[ ] Ensure rollback procedures are documented
[ ] Verify backup jobs ran successfully on critical servers
Triage Process:
1. Monitor MSRC Update Guide (https://msrc.microsoft.com/update-guide)
2. Review Microsoft Security Blog for advisory summaries
3. Cross-reference with CISA KEV additions (same day)
4. Check vendor advisories (Qualys, Rapid7, CrowdStrike analysis)
5. Identify zero-day and actively exploited vulnerabilities
6. Classify each CVE by severity and applicability
7. Determine deployment rings and timeline for each patch
8. Submit emergency change request for zero-day patches
9. Communicate triage results to IT Operations and management
# Post-Patch-Tuesday scan workflow
def run_patch_tuesday_scan(scanner_api, target_groups):
"""Trigger vulnerability scans after Patch Tuesday updates."""
for group in target_groups:
print(f"[*] Scanning {group['name']}...")
scan_id = scanner_api.launch_scan(
target=group["targets"],
template="patch-tuesday-focused",
credentials=group["creds"]
)
print(f" Scan launched: {scan_id}")
# Wait for scan completion, then generate report
results = scanner_api.get_scan_results(scan_id)
missing_patches = [r for r in results if r["status"] == "missing"]
# Categorize by Patch Tuesday release
current_month = [p for p in missing_patches
if p["vendor_advisory_date"] >= patch_tuesday_date]
return {
"total_missing": len(missing_patches),
"current_month": len(current_month),
"zero_day": [p for p in current_month if p.get("actively_exploited")],
"critical": [p for p in current_month if p["cvss"] >= 9.0],
}
Ring 0 - Emergency (0-48 hours):
Scope: Zero-day and actively exploited CVEs only
Method: Manual or targeted push (SCCM expedite)
Targets: Internet-facing servers, critical infrastructure
Approval: Emergency change, verbal CISO approval
Rollback: Immediate rollback if service degradation
Ring 1 - Pilot (Day 2-7):
Scope: All critical and high patches
Method: WSUS/SCCM automatic deployment
Targets: IT department machines, test group (5-10%)
Approval: Standard change with CAB notification
Monitoring: 48-hour soak period, check for BSOD, app crashes
Ring 2 - Production Servers (Day 7-14):
Scope: All security patches
Method: SCCM maintenance windows (off-hours)
Targets: Production servers by tier
Approval: Standard change with CAB approval
Monitoring: Application health checks, performance baseline
Ring 3 - Workstations (Day 14-21):
Scope: All security patches + quality updates
Method: Windows Update for Business / Intune
Targets: All managed workstations
Approval: Pre-approved standard change
Monitoring: Help desk ticket monitoring for issues
Ring 4 - Stragglers (Day 21-30):
Scope: Catch remaining unpatched systems
Method: Forced deployment with restart
Targets: Systems that missed prior rings
Approval: Compliance-driven enforcement
Post-Deployment Validation:
1. Re-scan environment with updated vulnerability signatures
2. Compare pre-patch and post-patch scan results
3. Calculate patch compliance rate per ring and department
4. Identify failed patches and investigate root causes
5. Generate compliance report for management review
6. Update risk register with residual unpatched vulnerabilities
7. Document exceptions and compensating controls