A question about the

Patches

table for windows: the description is

Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update

- which kind of implies it shows almost none of the patches installed

the documentation could be more clear. This table in osquery is a proxy for the

Win32_QuickFixEngineering

WMI class, which lists "quick-fix engineering (QFE) updates" to the operating system. Starting with Windows Vista, this class returns only the updates supplied by Component Based Servicing (CBS). https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/system/windows/patches.cpp#L19