Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

patches

The patches osquery table lists Windows security patch updates.

Column	Type	Description
caption	text	Short description of the patch.
csname	text	The name of the host the patch is installed on.
description	text	Fuller description of the patch.
fix_comments	text	Additional comments about the patch.
hotfix_id	text	The KB ID of the patch.
install_date	text	Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.
installed_by	text	The system context in which the patch as installed.
installed_on	text	The date when the patch was installed.

Example

Basic query:

SELECT * FROM patches;

This query determines if a specific hotfix patch is installed:

SELECT * FROM patches WHERE hotfix_id='kb5037663';

Notes

Microsoft creates a support page per hotfix patch. Support pages can be discovered by doing a web browser search for the hotfix ID string (e.g., KB5037663).

Microsoft documentation for KB5037663

The patches table does not include updates that are applied via Windows Installer / Microsoft Standard Installer packages (.msi) or updates downloaded directly from Windows Update (e.g., Service Packs).

Windows Installer

Edit page