Katello 2.2: how to show which (CentOS ideally) clients have outstanding package updates

Hi - How can I tell, from Foreman or otherwise, when my clients have
package updates available (other than just trying Content Hosts ->
{individual client} -> Packages - 'Update All' )?

Ideally, I could generate a report of updates outstanding, by client, for
my Change Request, then apply en masse or with exclusions? Is this not

Many thanks.