ok I’m going around in circles a bit here. @Kathy Satterlee kindly pointed me to the ‘configuration files’ docs to add permanent queries to my hosts.
This shows the syntax and formatting, but doesn’t show me where those files are/ should be located.
The page about ‘query packs’ seems to infer that configuration should be done with fleetctl, and on the FAQ page there’s a link that says ‘Check out an example configuration file with the additional_queries field’ but this just goes back to the config options page.
Question- am I required to interact with these files via fleetctl, or can I edit them directly? If yes, where are they please?
For clarity, this is what I’m trying to find/ edit