Live discover: How to check Windows updates Available or not installed

I have an update on this that may help you on this, But this is only a Live discover query at the moment.

The below query lists the updates available and returns the status if they are installed and mandatory or not.

SELECT
    title,
    support_url,
    msrc_severity,
    installed,
    mandatory,
    size,
    kbarticle
FROM
    win_update

Thank you very much. I understand!

That's Great! As I mentioned earlier, This query can only lists the patches installed.

Microsoft doesn't keep a list of KB Articles to CURL and check against so the best we could do is query the patch table in OSQuery against the install date to see when the system was last patched. The only information we could get is about the applied patches.

I already have information, but show me only the updates installed and not the patches available or pending for install.

Thank you.

Thanks for your information RaviSoni.

I had indeed disabled this option. I enabled it and run the query "Windows updates patch (Data Lake)", however, it is taking a long time and I haven't got any results yet, Is that normal?

This query will "Lists all the update patches installed on endpoints." 

As this is a datalake query, Can you confirm the below datalake setting in Sophos Central?

Global Setting > Under Endpoint Protection > Data Lake Uploads

For reference,
https://community.sophos.com/intercept-x-endpoint/b/blog/posts/sophos-xdr-and-edr-4-0-now-available