Hey all, I’m testing out distributed queries. I’ve specified a distributed read & write endpoint along w/

distributed_plugin=tls

. With

—ephemeral

, I’m assuming enrollment would happen on command execution which is not.

$sudo  /usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf --ephemeral --verbose --tls_dump --database_path /osquery.db
I1118 18:36:59.329648 28198 tls.cpp:240] TLS/HTTPS POST request to URI: https://[REDACTED].net/[DISTRIBUTED-READ]
{"node_key":""}

I1118 18:36:59.487841 28210 interface.cpp:105] Registering extension (processes_security, 7496, version=, sdk=)
I1118 18:36:59.488283 28210 registry_factory.cpp:109] Extension 7496 registered table plugin processes_security
"{\n\t\t\"queries\": {\n\t\t\t\"info\": \"select count(1) from osquery_info\",\n\t\t\t\t\"flags\": \"select count(1) from osquery_flags\",\n\t\t}\n\t}"