@groob The config is: { "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", "schedule_splay_percent": "10", "database_path": "/var/osquery/osquery.db", "utc": "true" }, "schedule": { "system_info": { "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;", "interval": 3600 } }, "packs": { "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf", "incident-response": "/usr/share/osquery/packs/incident-response.conf", "it-compliance": "/usr/share/osquery/packs/it-compliance.conf", "vuln-management": "/usr/share/osquery/packs/vuln-management.conf", "hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf", "ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf", "tokenvault-fim": "/usr/share/osquery/packs/tokenvault-fim.conf" }, "feature_vectors": { "character_frequencies": [ 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.00045, 0.01798, 0.0, 0.03111, 0.00063, 0.00027, 0.0, 0.01336, 0.0133, 0.00128, 0.0027, 0.00655, 0.01932, 0.01917, 0.00432, 0.0045, 0.00316, 0.00245, 0.00133, 0.001029, 0.00114, 0.000869, 0.00067, 0.000759, 0.00061, 0.00483, 0.0023, 0.00185, 0.01342, 0.00196, 0.00035, 0.00092, 0.027875, 0.007465, 0.016265, 0.013995, 0.0490895, 0.00848, 0.00771, 0.00737, 0.025615, 0.001725, 0.002265, 0.017875, 0.016005, 0.02533, 0.025295, 0.014375, 0.00109, 0.02732, 0.02658, 0.037355, 0.011575, 0.00451, 0.005865, 0.003255, 0.005965, 0.00077, 0.00621, 0.00222, 0.0062, 0.0, 0.00538, 0.00122, 0.027875, 0.007465, 0.016265, 0.013995, 0.0490895, 0.00848, 0.00771, 0.00737, 0.025615, 0.001725, 0.002265, 0.017875, 0.016005, 0.02533, 0.025295, 0.014375, 0.00109, 0.02732, 0.02658, 0.037355, 0.011575, 0.00451, 0.005865, 0.003255, 0.005965, 0.00077, 0.00771, 0.002379, 0.00766, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0 ] } }