The InstalledUpdates collector gathers data about installed updates, hotfixes, and security updates on Windows devices.
Collector output
Field | Type | Description |
|---|---|---|
description | String | The description for the update package. |
hotfix_id | String | Microsoft knowledge base identifier for the update package. |
install_date | Timestamp | The date when the package was installed. |
installed_by | String | The user name that performed the installation, qualified by its namespace. |
Supported versions
Windows | Linux | macOS |
|---|---|---|
3.0 and later | 3.0 and later | 3.0 and later |
Example: Show which hotfix packages were installed by bad_user.
InstalledUpdates where InstalledUpdates description equals "Hotfix" and InstalledUpdates installed_by contains "bad_user"
What patches are installed
InstalledUpdates hotfix_id, install_date, installed_by, description
Which patches are security updates
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates description equals "Security Update"
Which patches are hotfix updates
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates description equals "HotFix"
Which patches were not installed by NT authority
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates description equals "HotFix"
Specify - patch by KB number
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates hotfix_id equals "KB3097992"
Specify - patch by date installed
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates installed_date after "2018-03-01"
Specify - track a patch after a response date
InstalledUpdates hotfix_id, install_date, installed_by, description WHERE InstalledUpdates install_date after "2018-03-01" AND InstalledUpdates hotfix_id ends with "KB4012212" OR InstalledUpdates hotfix_id ends with "KB4012215" OR InstalledUpdates hotfix_id ends with "KB4012218" OR InstalledUpdates hotfix_id ends with "KB4015549"