is it possible to display the installed version or build of Windows 10 in Central? e.g. 20H2?
you could do it with live discover, if licensed.
the query is Device>Hardware and operatin system details
I've not played with the data lake queries as much but does:
SELECTdistinct(meta_hostname),meta_os_name,meta_os_version,meta_username,meta_ip_address,meta_boot_timeFROM xdr_dataWHERE query_name = 'windows_updates_patch'group by meta_hostname,meta_os_name,meta_os_version,meta_username,meta_ip_address,meta_boot_time
help, it would save waiting for machines to come online if they have sent some info up.
works even better than the live query - and as you said: no waiting time and you can collect info from offline machines.