Hello everyone 👋 I have a question regarding orbit and using a filesystem config plugin for osquery. Given I have orbit on a mac machine connected to fleetdm, if I wanted to update the orbit agent so that the osquery deamon read in a filesystem config plugin that could then be queried from fleetdm, would that be as simple as updating the agent YAML with something like this:

config:
command_line_flags: {
    config_path: /var/osquery/osquery.conf
}

Thread in #general

Hello @Kathy Satterlee, thanks for getting back to me. My understanding of the docs was that you could update osquery cmd line flags from Fleet, which I assumed meant that orbit would re-run osquery with the cmd line flags and arguments you gave. Are you saying it's possible I can do something like Automatic Table Construction or Yara rules directly from the fleetdm admin config?

You absolutely can! https://fleetdm.com/docs/using-fleet/configuration-files#agent-options-config

You are amazing @Kathy Satterlee, I really appreciate it!

Glad that helped :)