@sroberts are you sure osquery is parsing your config correctly in that situation?