Assuming we are talking about /opt/so/saltstack/default/salt/fleet/files/packs/osquery-config.conf being what is meant by "setting the following app config" , which is done, followed by so-fleet-restart, it's still not enabled. I'm using 4.14.0 Fleet thats on the current Version: 2.3.140 of Security Onion. The current guidance out there isn't working. Thanks.

@defensivedepth how would the configuration be managed in Security Onion?

Thanks for the CC @Kathy Satterlee @James Wilburn Best thing to do is post this on the Security Onion Community Support forums - SecurityOnion.net/discuss