OMS / Log Analytics - Filter Servers vs. Client computers

Hi,

I see the OS information is not always populated in the "Update" table, so if that's the case you can join on the "Heartbeat" table, like in this query:

Update 
| where UpdateState == "Needed" and Optional == "false" and Classification in ("Security Updates", "Critical Updates")
| join kind= leftouter (
   Heartbeat
   | summarize by Computer, OSType, RemoteIPCountry, Version
) on Computer 
| project TimeGenerated, SourceComputerId, PublishedDate, Title, Classification, Computer, OSType1, Version, Product, RemoteIPCountry 

note that in the last "project" line, I include OSType1 (taken from Heartbeat table) instead of OSType (from the Update table) which is empty. That way you also get the Version (of the OS) and RemoteIPCountry to filter by. I hope the OS Type and version together can help you identify client vs server OSs.

HTH,

Noa