hello everyone. I think this question belongs here vs #C01DXJL16D8, but could go either way I guess. After watching one of the presentations at osquery@scale (Reliable osquery deployment for the paranoid), we have decided that we are going to manage our osquery config at our clients (via puppet mostly) vs setting the config centrally at Fleet (which we do currently). Current config in our flags file (minus anything sensitive), some of which is already being overridden by Fleet:

--enroll_secret_path=

--tls_hostname=

--host_identifier=

--enroll_tls_endpoint=/api/v1/osquery/enroll

--config_plugin=tls

--config_tls_endpoint=/api/v1/osquery/config

--config_refresh=3600

--disable_distributed=false

--distributed_plugin=tls

--distributed_interval=60

--distributed_tls_max_attempts=3

--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read

--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write

--logger_plugin=tls

--logger_tls_endpoint=/api/v1/osquery/log

--logger_tls_period=10

I'd just like to confirm the recommended approach to do that would be to remove the following settings from our osquery.flags file (and remove the config we are setting at Fleet - the stuff in osquery options / fleetctl get options):

--config_refresh

--config_plugin

--config_tls_endpoint

Anything else?