by checking things in osquery_flags