Patch management

Infrastructure → Patches (/gravity/patches) shows patch scan results collected from your enrolled fleet agents - which hosts have updates available, and which package manager they use. This page is about reading that data; for the broader software picture, see Software inventory.

What’s collected

An agent with the patch-scanning capability granted scans for available OS package updates roughly every 24 hours (the first scan runs about 5 minutes after the agent starts). Each scan reports:

• The package manager in use (apt, dnf, zypper, detected automatically)
• How many updates are available
• How many have been applied
• When the scan ran
• Any error the scan itself hit
• Any maintenance windows configured for that host

Reviewing pending patches

1. Open Infrastructure → Patches.
2. Filter by status (Scanned / Applying / Applied / Failed) or by OS.
3. Click View Details on any row for the full picture: package manager, exact counts, scan timestamp, configured maintenance windows, and the error message if the scan failed.

A host with a high Updates Available count is highlighted so it stands out in the list.

Status meanings

Status	Meaning
Scanned	The agent completed a scan; the counts shown are current as of that scan
Applying	An apply is in progress on that host
Applied	The host’s available updates were applied successfully
Failed	Either the scan or an apply attempt failed - open the row for the error message

No customer-reachable path currently produces the Applying or Applied states - see the note below before waiting for either to appear.

Patch scanning detects apt, dnf, or zypper - the package managers used by the Linux distributions the fleet agent supports. A host with no package manager detected won’t produce a scan result.

What this page does - and doesn’t - do

Caution

This screen is a report, not a control panel. There’s no button here to apply updates to a host, and no automatic or scheduled apply happens today either. The maintenance windows shown in a patch run’s details are informational only - there’s no screen to configure them, and nothing currently reads them to decide when to apply anything.

Granting a host’s agent the patch-apply capability (from Fleet → Agents → Grant Capability) is a prerequisite for applying updates, but on its own it does not cause anything to be applied. Even with the capability granted, Sencai does not trigger patch applies on a schedule, and there is no self-service way to trigger one from the app. Apply updates on the host yourself - the next scan (within about 24 hours) will show the reduced Updates Available count.

Patches vs. vulnerabilities

This page reports available OS package updates - it’s about what your package manager considers out of date, not a CVE feed by itself. If you’re specifically tracking known vulnerabilities across your infrastructure rather than pending package updates, see Vulnerabilities, which covers that side of the picture separately.

As with the rest of the fleet section, results here are scoped to your own organization’s agents - you won’t see another customer’s patch data, and they won’t see yours.

What’s next

• Software inventory - the broader picture of what’s installed
• Agent policies - autonomy levels, freeze windows and blast radius for automated action (capabilities are granted on Fleet → Agents)
• Monitoring - host telemetry alongside patch status
• CIS hardening - hardening checks on the same hosts