Anybody successfully created a detection rule for Red Hat security updates

Elastic Security
1

I read that is is possible to create a detection rule to alert if there are security updates required on a Red Hat or CentOS box (we use RHEL for production, CentOS for testing).

I came across the following "query" but apparently I don't have things configured to access some of the values:

(system.os.name: "Red Hat" OR system.os.name: "CentOS") AND system.package.updates: >0 AND system.package.update.type: "security"

I don't appear to have system.os or system.package.

I would greatly appreciate it if anybody has accomplished this and is willing to share insight, or if someone knows an accurate resource they can point me to.

Thanks in advance!

2

There must be an integration added, beat running on the target machines producing documents with such content.

Did the query indicate required integration?

I think such objective can be achieved with

You can create a scheduled query to probe for available system updates.