HIP check Patch Management

[Henley]

Hello, I am trying to setup a HIP Profile for contractors accessing our network over Global Protect.
This HIP Profile is checking if version of Windows is supported(allowing only 8.1 and 10), then checking if Anti-Malware and Firewall is enabled and as a last check I want to check if Windows patches are up to date.
Checks for OS, Anti-Malware and Firewall are working fine but I am struggling with Patch-Management check.

On Global Protect Client on my not-updated test computer I can see that I am missing 3 patches. Two of them are of severity 2 and one is severity -1.

I was trying several combinations like the on on picture, on Patch Management HIP object tab but without success.

I want to achive that this HIP Profile will only allow user if there are no severity 2 or 3 Patches missing. What I need to set-up on Patch management tab to do so?

Thanks for any hint or help.

[wcoulson]

shot in the dark here since this is 15 months old. but did you ever happen to get this figured out?