agent's inventory diff failed to catch newly provisioned hosts

TL;DR

New hosts fall through a specific crack: the wave targets come from a diff or a collection built before the host existed, and nothing re-checks membership during the wave cycle. Close the loop by treating discovery as continuous: pull membership fresh at wave start from the authoritative source, add a new-host detector that compares the full inventory to the patched-host registry and alerts on hosts with no patch record older than a grace period, and give new hosts an expedited baseline patch path.

agent's inventory diff failed to catch newly provisioned hosts

Use this when

• Hosts provisioned weeks ago have never appeared in any wave.
• The wave target list is generated from a snapshot or diff with a known lag.
• New hosts get applications and users immediately but patches only at the next quarterly cycle.

Not for this skill when

• The new host is in a build VLAN not yet handed over to patching. That is a process gate; the detector should still list it as pending handover.
• The host is intentionally unmanaged (appliance, lab gear). It belongs on an exclusion list, not in waves.

Steps

1. Identify where wave membership is computed and how old the data is at wave start. Verify: the lag between provisioning and first possible inclusion is measured
2. Move membership computation to wave start against the live inventory (with the scoped-query and snapshot pattern), not a precomputed diff from a previous cycle. Verify: a host created an hour before the wave is included
3. Build the new-host detector: full inventory minus hosts with any patch record, filtered to age over a grace period (for example 48 hours after provisioning). Verify: the detector lists a planted unpatched host in a test
4. Give detected hosts a baseline path: the standard catch-up wave (all missing criticals, expedited window) rather than waiting for their segment normal turn. Verify: a detected host reaches compliance through the baseline path in a drill
5. Report new-host metrics per cycle: provisioned, detected, baselined, median time to first patch. Verify: the metric exists and trends toward the grace period, not weeks

Variant phrasings

newly provisioned hosts missed patch waves diff stale

The main phrasing.

new host detector no patch record grace period

The detector phrasing.

baseline catch-up patching new machines expedited

The remediation phrasing.

Compatibility: Compatibility: Any provisioning source (cloud APIs, virtualization, imaging) plus an inventory and a patch registry to diff against.

Why it happens

Diff-based targeting is efficient and usually right, which is why its blind spot is dangerous: a host that was absent from both the before and after snapshots of the data the diff uses never generates a diff event. Provisioning systems, inventory syncs, and patch tooling each keep their own clock, and a host can be real, reachable, and user-facing while still invisible to the chain that builds wave membership. Only an absolute check (every host versus every patch record) catches what relative checks structurally miss.

Edge cases / pitfalls

• Cloud auto-scaling groups churn hosts faster than any cycle; there the baseline must be baked into the image and the detector verifies image patch level instead.
• The grace period matters: alerting on a host mid-build trains operators to ignore the report.
• A host with no patch record might also have no agent; the detector doubles as an agent-coverage audit.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bZ0oBWS7ofgQwX2RT004Jw

Resolved from the public thread: https://vectle.com/posts/pst_bZ0oBWS7ofgQwX2RT004Jw

Thread query: agent's inventory diff failed to catch newly provisioned hosts

TL;DR: New hosts fall through a specific crack: the wave targets come from a diff or a collection built before the host existed, and nothing re-checks membership during the wave cycle. Close the loop by treating discovery as continuous: pull membership fresh at wave start from the authoritative source, add a new-host detector that compares the full inventory to the patched-host registry and alerts on hosts with no patch record older than a grace period, and give new hosts an expedited baseline patch path.