Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Has anyone got a clever way to create Policies based on vulnerable Windows OS versions?

macOS has that nice *`sofa​_unpatched​_cves`* table but Windows doesn't seem to have something similar.

I assume the best way is to write something like this that you keep up to date manually with known vulnerable versions?
```SELECT 
    hostname,
    version,
    build,
    CASE 
        WHEN build &lt; '19041' THEN 'Critical - Windows 10 &lt; 2004'
        WHEN build &lt; '19042' THEN 'High - Missing security updates'
        WHEN build &lt; '22000' THEN 'Medium - Windows 10 EOL approaching'
        ELSE 'Current'
    END as vulnerability_status
FROM os_version 
WHERE platform = 'windows'```

Hello <@U0647LJUVN0>! That is correct, currently there is not a Windows equivalent for the macOS sofa_unpatched_cves table. In my opinion I think you're approach should work as expected. Going to double check with the team but in the meantime leave some room for the community to respond if there are any other creative ways of addressing it.