Creating Patch Block Rule

Before you go ahead with creation of the patch blocking rule, ensure you have completed the pre-requisites. 

Prerequisites

• You have the Manage Patch Blocking Rules permission. The Manager role is granted this permission by default.
• If you plan to create a tag-based rule, the asset tags you want to use already exist and are applied to the relevant assets.
• You know the patch QQL that identifies the patches you want to block. Use the Preview option while creating the rule to confirm the query returns the patches you expect.

To create patch blocking rule

• Go to TE > Configuration > Patch Blocking Rules.
• Select the platform tab for the patches you want to block: Windows, Linux, or Mac. Rules are counted and applied per platform.
• Click Create Rule.
• Under Basic Details, provide:
  • Name: Enter a name for the rule. This name is shown to users in the job results whenever the rule blocks a patch, so choose something meaningful. Maximum 64 characters.
  • Blocking Reason: Enter the reason why these patches are being blocked, for example a known issue, a pending vendor fix, or a change-control decision. Maximum 1000 characters.
• Under Criteria (QQL), select Patch and enter the patch QQL that identifies the patches to block. For example:
  • patch.appFamily:Windows
  • patch.isFeatureUpdate:true
  • patch.vendor:`Adobe`
• Click Preview. The Resulting Patches list shows the patches that your query matches, along with their title, architecture, bulletin, and KB, and the total count. Refine the query until the list contains only the patches you intend to block.
• Under Scope, choose which assets the block applies to:
  • To block the patches on specific assets, click the add ( +) icon and select up to five asset tags. The rule applies to hosts carrying any one of the selected tags.
  • To block the patches on all assets in the subscription, leave the tag list empty. The rule is saved with a Global scope.
• Click Save.

The new rule appears on the platform's Patch Blocking Rules list, showing its name, criteria, scope, who created and last edited it, and its tags. The block takes effect on subsequent job runs. On the Patches tab, for each platform, use the Blocked and Not Blocked filter to search for the respective patches. 

A rule blocks up to 500 matching patches. If your patch QQL matches more than 500, the rule is still created, but only the 500 most recently published patches are skipped during deployment. To block more, split them across several rules with narrower criteria.

Managing Patch Blocking Rules

You can view, edit and delete patch blocking rules using the Quick Actions menu. 

• All rules for the selected platform are listed on its tab, with the Criteria (QQL), Scope, Created, Last Edited, and Tags for each.
• Click a rule name to open it and review or change its details, criteria, or scope.
• Select the approprate rule and use the Actions menu to view, edit and delete the rule.
• To unblock patches, delete the rule, or edit it so that its criteria or scope no longer cover them. Once the rule no longer applies, those patches are deployed normally by the next job run.

You can also review the patches that are currently blocked from the Patches tab by applying the blocked-patches filter, which is useful when you are deciding which blocks are ready to be lifted.