Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi guys, do you know in what cases the osquery agents will re-enroll ?

I think they will enroll f they don't have a `node_key` in their local DB. E.g. if you delete the DB, the next time osqueryd is running, it will try to enroll.

<https://osquery.readthedocs.io/en/stable/deployment/remote/#remote-authentication>

If we change the fleet's db, will it trigger the agent to re-enroll?

Change it how? I'd normally just delete the whole `/var/osquery` directory.

change to a new db which has no entries in the host table

I'm sorry, but I don't understand what that means. I'm talking about osqueryd's database, not Fleet's.

maybe if you deleted the node from Fleet's UI, that would probably cause it to re-enroll.

Actually, that would probably cause an authentication error when the node tried to talk to Fleet because its `node_key` would be missing from Fleet's DB.