{
  "options": {
    "disable_extensions": "true",
    "logger_plugin": "syslog",
    "host_identifier": "hostname"
  },
  "file_paths": {
    "etc": [
      "/etc/osquery/%%",
      "/etc/ssh/sshd_config",
      "/etc/group",
      "/etc/passwd",
      "/etc/gshadow",
      "/etc/shadow",
      "/etc/security/opasswd",
      "/etc/sudoers",
      "/etc/pam.d/%%",
      "/etc/security/limits.conf",
      "/etc/security/pam_env.conf",
      "/etc/security/namespace.conf",
      "/etc/security/namespace.init",
      "/etc/localtime",
      "/etc/hosts",
      "/etc/sudoers.d/%%"
    ],
    "home": [
      "/home/%/.ssh/%%"
    ],
    "root": [
      "/root/.ssh/%%"
    ]
  },
  "schedule": {
    "file_events": {
      "query": "SELECT * from file_events;",
      "removed": false,
      "interval": 60
    }
  }
}