Sorry I'm dense though, does the config listed in https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/ go into

/etc/osquery/osquery.conf

?