afaik, osquery.flags file can only contain flag parameters such as --events_max --disable_distributed etc osquery.conf file can contain both flags parameters and queries (also query packs) for example { “options”: { “host_identifier”: “hostname”, “schedule_splay_percent”: 10 “read_max”: 100000, “events_max”: 100000, “enable_monitor”: true, “host_identifier”: “uuid” }, “schedule”: { “macos_kextstat”: { “query”: “SELECT * FROM kernel_extensions;“, “interval”: 10 }, “foobar”: { “query”: “SELECT foo, bar, pid FROM foobar_table;“, “interval”: 600 } …. } }