> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Patch & Update Management

> Review pending operating-system updates across your hosts and approve or reject the update schedules the AI proposes — with WSUS on Windows.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

The **Updates** area is where you keep your hosts patched. It shows the operating-system updates pending on each device and lets you approve the schedules for rolling them out — following Myrmex's usual pattern: the AI proposes, you decide.

## Opening the Updates Area

Reach it from the **Directory** on the left of the console — **Updates** is one of the quick actions above your environment. It opens as a tab in the Workspace, scoped to the [context](/documentation/get-started/concepts#how-your-account-is-organized) you have selected. You can also open it straight from chat by asking about a host's updates.

<Note>
  Update management is **host-scoped** — it covers the devices running the Myrmex
  agent, not your integrations.
</Note>

## What You'll See

<CardGroup cols={2}>
  <Card title="Pending patches" icon="list-check">
    A read-only, per-host view of the OS updates outstanding across your fleet —
    queried live, on demand. Consulting it changes nothing.
  </Card>

  <Card title="Applied as governed changes" icon="clipboard-check">
    Actually installing updates happens through a patch **change record (GMUD)**
    with approval — never straight from this view.
  </Card>
</CardGroup>

## How Patching Works

Consulting is separate from applying. The pending-patches view is **read-only** — it never installs anything. Applying updates is a governed change:

<Steps>
  <Step title="Consult what's pending">
    Review the OS updates outstanding on each host. Myrmex queries your online
    hosts live, on demand — nothing is stored, and nothing is applied.
  </Step>

  <Step title="The AI proposes a patch change">
    [Centurion](/documentation/multi-agent-system/agent-orchestrator) turns the
    updates you want into a **patch change (GMUD)** with a maintenance window.
  </Step>

  <Step title="You approve">
    The patch change passes through the
    [approval gate](/documentation/change-management/approvals). Approving
    authorizes the agent to install the updates in the next maintenance window —
    recorded under your user. Nothing lands on a host without approval.
  </Step>
</Steps>

This keeps you in control of when changes land on production systems, while the AI handles the legwork of tracking what's pending and organizing the rollout. The rollout is tracked as a [change record](/documentation/change-management/overview), with the same lifecycle and audit trail as any other change.

## Windows Updates

On Windows hosts, Myrmex works through **WSUS** (Windows Server Update Services) to approve and deliver operating-system updates, fitting into the standard Windows update mechanism.

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Device details" icon="server" href="/documentation/agent-endpoint-security/device-details">
    Open a host to see its details alongside its updates.
  </Card>

  <Card title="Endpoints view" icon="table-list" href="/documentation/agent-endpoint-security/endpoints-view">
    Browse the fleet you're keeping patched.
  </Card>

  <Card title="Change Management" icon="clipboard-check" href="/documentation/change-management/overview">
    How patch changes are approved and executed alongside standard changes.
  </Card>
</CardGroup>