A question about the `Patches` table for windows: ...
# general
A question about the
table for windows: the description is
Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update
- which kind of implies it shows almost none of the patches installed
the documentation could be more clear. This table in osquery is a proxy for the
WMI class, which lists "quick-fix engineering (QFE) updates" to the operating system. Starting with Windows Vista, this class returns only the updates supplied by Component Based Servicing (CBS). https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/system/windows/patches.cpp#L19