Determine Mac Patches installed

The security updates, as with the OS updates, change the OS build number. For example:
16G1036 = 10.12.6 with Security Update 2017-001
16G1114 = 10.12.6 with Security Update 2017-002

You could create a smart group based on that.

Seems to work for me!

Source: @crytallized via macadmins slack

@georgecm12 Thanks very much, thats exactly I needed and have created a smart group. Is there somewhere I can reference the build number when there is a new patch update etc?

Stick with using Operating System Build for your criteria for the most reliable indicator

Receipts are only written when you install those packages in a standalone way like via Policy Relying on Packages Installed By Installer.app/SWU is not going to work if updates are installed via Mac App Store or if you run softwareupdate at the command line.

15G18013 = 10.11.6 with Security Update 2017-005
16G1114 = 10.12.6 with Security Update 2017-002

The last bit though is that while you can make a Smart Group based on these values, once the build changes due to another Security update, it'll 'break' so an Extension Attribute that is able to do Greater Than/Less Than with build would require less maintenance... but yeah let's just get stuff patched now, right?

@brunerd Good idea! Sticking with the build is probably wisest. While I haven't tested the Mac App Store yet, I can say that running our software update script (which does use softwareupdate via command line) has resulted in receipts being written for these security updates.

How do you determine what the build number of a update will be?

if "16G1114" is the build number for 10.12.6 with Security Update 2017-002. Is there somewhere like a official page/url that confirms when a update is applied the build number will be XXXXXX?

@andymcp As a matter of fact the receipts for 10.13.2 Supplemental did show up in /System/Library/Receipts
I was working on 10.12.6 machine and it just didn't seem that they were getting there... weird.

@Quan.nong I haven't Google searched for the saint who would keep track of all these build numbers... so if Receipts work then go with that...

FYI
17C205 = 10.13.2 with Supplemental Patch

Double FYI - Apple removed all references to 10.11.6 and 10.12.6 for CVE-2017-5754 "Meltdown" fix in
"About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan"
https://support.apple.com/en-us/HT208331

@andymcp Thanks very much... Your advice has been greatly appreciated and much help!

Thanks to everyone for their advice and assistance!!!

So so helpful