Add built-in tables for Windows security releases and unpatched CVEs #58721

• Unpacked: TODO: Head of Product Design (HPD) checks this box when the request goes through "Unpacking the why": https://fleetdm.com/handbook/product-design#unpacking-the-why
• Gong snippet: https://us-65885.app.gong.io/call?id=4041089789432637429&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A97%2C%22to%22%3A171%7D%5D

Interpretation

How do you interpret the customer's words?
The customer built an osquery extension in Go that exposes Windows patch and CVE data from a community feed as two tables, one for security release history per Windows version and one for the actively exploited CVEs a host has not yet patched, and they sideload its binary onto hosts today. The request is to add these tables to Fleet, and the extension's source is at https://github.com/jjhfarmer/wofa-osquery-extension.

What's Fleet missing?
Fleet has no built-in table for Windows security releases or unpatched actively exploited CVEs, so IT admins cannot write queries or policies on this data without deploying an extension.

What does the customer's ideal workflow look like?

1. Fleet ships tables in fleetd for Windows security releases and unpatched CVEs, including the CISA KEV flag.
2. An IT admin creates a policy that fails when a Windows host is missing a patch for a known exploited CVE.
3. The IT admin does not deploy a separate binary.