Hi,
you can create external parameter that will execute this command and return security patch number, something like
ExternalParameterShellExec = ExchangePatchNumber:pwsh -Command "& { Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo} }"
in nxagentd.conf (not sure about exact PowerShell syntax, but you should get an idea). Agent will provide new metric ExchangePatchNumber that should return output of given command as value.
Best regards,
Victor