Display installed Version of Windows 10

you could do it with live discover, if licensed.

the query is Device>Hardware and operatin system details

you could do it with live discover, if licensed.

the query is Device>Hardware and operatin system details

I've not played with the data lake queries as much but does:

SELECT
distinct(meta_hostname),
meta_os_name,
meta_os_version,
meta_username,
meta_ip_address,
meta_boot_time
FROM xdr_data
WHERE query_name = 'windows_updates_patch'
group by meta_hostname,meta_os_name,meta_os_version,meta_username,meta_ip_address,meta_boot_time

help, it would save waiting for machines to come online if they have sent some info up.

works even better than the live query - and as you said: no waiting time and you can collect info from offline machines.

thanks!