Control: System updates should be installed on your machines

powerpipe control run azure_compliance.control.compute_vm_system_updates_installed

powerpipe login
powerpipe control run azure_compliance.control.compute_vm_system_updates_installed --share

select
  vm.vm_id as resource,
  case
    when enable_automatic_updates then 'ok'
    else 'alarm'
  end as status,
  case
    when enable_automatic_updates then vm.title || ' automatic system updates enabled.'
    else vm.title || ' automatic system updates disabled.'
  end as reason
  
  , vm.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_compute_virtual_machine as vm,
  azure_subscription as sub
where
  sub.subscription_id = vm.subscription_id;