https://github.com/osquery/osquery logo
Title
a

Alex Alborzfard

04/06/2020, 5:34 PM
I'm a newbie...Trying to write a one-time query to check if a specific Windows patch has been installed on all hosts or on specific hosts.
s

sundsta

04/06/2020, 5:42 PM
You can do this with the patches table. See https://osquery.io/schema/4.2.0#patches
a

alessandrogario

04/06/2020, 7:01 PM
a

Alex Alborzfard

04/06/2020, 7:14 PM
So would this work:
Select * from Patches where csname=<hostname> AND hotfix_id=<kbname>
Also where in Fritz's script there's an option to specify KB# and host name(s)?
This gets applied and reboot status
Also make sure to include all "equivalent" KBs across your different OS versions - sometimes its not the number, so this uses a list