--enroll_secret_path=C:\Program Files\osquery\certs\secret
--tls_server_certs=C:\Program Files\osquery\certs\devo-ua-manager.crt
--tls_hostname=devo-ua-manager:8080
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=filesystem
--config_refresh=10
--disable_distributed=false
--distributed_plugin=tls
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
--disable_events=false
--enable_windows_events_subscriber=true
--enable_windows_events_publisher=true
--extensions_autoload=C:\Program Files\osquery\extensions.load
--watchdog_memory_limit=512
--extensions_require=system-stats,fetchfiles
--disable_tables=curl
--events_expiry: 1
--events_max: 100000
--logger_min_status: 1
--distributed_interval: 60
--logger_snapshot_event_type: true
--schedule_splay_percent: 10
--tls_session_reuse: false

{
  "queries": {
    "events_windows": {
      "query": "SELECT *,\"events_windows.\" || lower(source) || \".\" || eventid as __devoSubTag FROM windows_events WHERE lower(source) IN ('application', 'setup', 'security', 'system');",
      "interval": 10,
      "platform": "windows",
      "description": "test"
    },
    "other_events": {
      "query": "SELECT *, \"events_windows.other_sources\" || \".\" || eventid as __devoSubTag FROM windows_events WHERE lower(source) Not IN ('application', 'setup', 'security', 'system', 'microsoft-windows-powershell/operational', 'microsoft-windows-powershell/admin');",
      "interval": 10,
      "platform": "windows",
      "description": "other source"
    }
  }
}