Audit Kb

Audit Windows update state against Microsoft KB bulletins.

Returns a single item for the audited OS, carrying one advisory per missing update, newest first. fixedPackage names the update to install.

osName labels the result and is echoed back as package; send whatever the host calls itself. What is missing is decided by kbList alone. The authoritative product name is affectedProducts on each advisory.

metrics is the advisory-level answer and both its halves are rollups: cvss is the highest score across the advisory's CVEs, epss the highest probability, carried as a one-element array. The full per-CVE listing lives in cvelistMetrics - that is the one place to ask for it. date and percentile in both blocks come from a single EPSS snapshot. If the EPSS store is unreachable, metrics.epss arrives empty rather than holding bare CVE ids.