Approved

over 3 years ago

This query is one you are recommended to read the full content of the post to use. It is not simply a copy and paste query, like others in the forum. It is valuable in the right situation

Live discover: How to check Windows updates Available or not installed

Hi friends,

I've been trying create a query about how display all patches or windows updates available from a server. I tried this, but doesn't work:

SELECT
meta_hostname AS ep_name,
hotfix_id,
caption,
description,
FROM xdr_data
WHERE query_name = 'windows_updates_patch'

Any idea?''

Thank you

Team Management Infrastructure Clients

Top Comments

RaviSoni over 4 years ago +1

I have an update on this that may help you on this, But this is only a Live discover query at the moment. The below query lists the updates available and returns the status if they are installed and…

Parents

RaviSoni over 4 years ago

This query will "Lists all the update patches installed on endpoints."

As this is a datalake query, Can you confirm the below datalake setting in Sophos Central?

Global Setting > Under Endpoint Protection > Data Lake Uploads

For reference,
https://community.sophos.com/intercept-x-endpoint/b/blog/posts/sophos-xdr-and-edr-4-0-now-available
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Team Management Infrastructure Clients over 4 years ago in reply to RaviSoni

Thanks for your information RaviSoni.

I had indeed disabled this option. I enabled it and run the query "Windows updates patch (Data Lake)", however, it is taking a long time and I haven't got any results yet, Is that normal?
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Team Management Infrastructure Clients over 4 years ago in reply to RaviSoni

Thank you very much. I understand!
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Team Management Infrastructure Clients over 4 years ago in reply to RaviSoni

Thank you very much. I understand!
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

No Data

Uncategorized

Anomalies

ATT&CK

Cloud Optix

Compliance

Data Lake

Device

Email

Events

Files

Live Response

Network

Other queries

Processes

Query Tips

Registry

Threat Hunting

User

Live discover: How to check Windows updates Available or not installed

Top Comments

Submitted a Tech Support Case lately from the Support Portal?