ManageEngine Threat Detection and Patch Management Complete Admin Workflow

Nothing in this workflow means anything until the data is fresh. The vulnerability database and the agent scans feed every screen that follows.

1. Open Threats & Patches and let the vulnerability database sync — an on-demand sync exists, but schedule the regular sync so new CVEs appear without you remembering
2. Confirm agents on all managed systems have completed a scan; a machine that has not reported in days is a blind spot, not a healthy machine
3. Check the Systems view for Attention Required entries — this is where zero-day and highly vulnerable machines surface first
4. Set your System Health Policy thresholds now (how many missing patches make a system vulnerable or highly vulnerable) so the colours mean the same thing every week

Run scans at least weekly. Daily scanning of internet-facing servers is what mature frameworks expect — match the rhythm to the risk, not to convenience.

A list of 1,284 missing patches is not 1,284 emergencies. Endpoint Central already sorts vulnerabilities by the signals that matter — CVSS score, CVE impact, exploit disclosure, age and whether a patch exists.

1. Filter first for vulnerabilities with a known exploit — these are the ones attackers are using today
2. Next, critical CVSS scores on machines users actually touch, especially anything internet-facing
3. Use the Zero-day Vulnerabilities view separately — if a fix exists, it jumps the queue; if not, ManageEngine offers tested mitigation scripts instead
4. Note the high-risk software findings too: unsupported and end-of-life software is a threat no patch will ever close

The honest rule: one exploited vulnerability on a real machine outranks fifty theoretical ones. Prioritise like an attacker, not like a spreadsheet.

By default, patches can be approved automatically without testing. For any office where a broken PC costs money, change that. The Test and Approve feature exists exactly for this.

1. Go to Threats & Patches → Deployment → Test and Approve and switch approval to Test and Approve
2. Create a test group of a few machines that mirror your real fleet — including the oldest PC and the one running the cranky office software
3. Let patches install on the test group first; approve manually after checking, or auto-approve after a set number of clean days
4. Use Decline on any patch that fails testing — declined patches stay out of deployments instead of failing every month

Note: the approval setting is global for the console. You cannot run test-and-approve for one office and full-auto for another in the same setup — plan your groups with that in mind.

With tested patches approved, Automate Patch Deployment (APD) does the heavy lifting: scan, download, deploy, report — on your schedule, not the users' patience.

1. Create APD tasks under Threats & Patches → Deployment → Automate Patch Deployment — separate tasks for security patches, third-party apps and antivirus definitions keep failures easy to read
2. Deploy in rings: IT and test machines first, one department next, everyone else last — a weekend apart is cheap insurance
3. Set the deployment policy: install outside office hours, let users postpone a reboot a limited number of times, then enforce it — an un-rebooted patch is often an un-applied patch
4. Turn on email notifications for task status so failures reach you before users reach you

Include third-party applications in the automation. Browsers, PDF readers and meeting apps are where most real-world exploits land.