the osquery docs document what the flags do. you need to pick the ones that work for your environment