Prisma Access HIP object Windows patch management

[K.Herath]

We have created a HIP profile and configured windows patch management. However, the options under this is not very clear. I have to get some clarifications on this

Missing Patches - Severity

1. When the operator is set to Greater Than or Equal To, what values are valid in the field?
2. We currently use 3, assuming this represents Critical Windows security patches. Please clarify whether this is correct and what the other values represent.
3. What do each of the three options in the Check drop-down mean?
4. How does each option behave when the Item Table is populated or left empty?
   Enforcement outcome
1. If the HIP profile is attached to a deny security policy, which combinations would block a Windows endpoint with missing Critical security patches?
2. What other useful enforcement outcomes can be achieved through different combinations of these settings?
   
   GlobalProtect Prisma Access