Another question, is there a way to centrally forward scheduled query result to a siem from fleet? I dont want each individual endpoint sending results, I want to go through fleet.

There is! You'd configure osquery to send logs via TLS to Fleet:

--logger_plugin=tls 
 --logger_tls_endpoint=/api/osquery/log 
 --logger_tls_period=10

From there, the path depends a bit on where you want the logs to wind up. A pretty common way to go about that is to stream the logs to an S3 bucket using Firehose and then pick them up from there with your SIEM. You can also use the filesystem logger in Fleet and use a log forwarder to push them wherever you need. https://fleetdm.com/docs/configuration/fleet-server-configuration#osquery-result-log-plugin

Cool, thats what I was looking for. Thanks!