Ted Dorosheff
02/02/2022, 12:56 AMoverrides
key. My osquery.conf file basically is in this format:
options
<stuff>
file_paths
<list of linux file paths>
overrides
platforms
windows
options
<same stuff as above>
file_paths
<windows file paths>
exclude_paths
<windows file paths>
darwin
options
<same stuff as above>
file_paths
<mac file paths>
When i start my daemon on a mac, i only see the linux file paths being loaded. My config is syntactically correct, osquery isn't barfing on it.zwass
02/02/2022, 12:59 AMoverrides
is only a Fleet thing. When you provide this as the agent options in Fleet, it will provide the appropriate platform configuration to osquery when it checks in for config.Ted Dorosheff
02/02/2022, 12:59 AMzwass
02/02/2022, 1:00 AMdarwin
section to JSON and then provide that to osquery -- that would be essentially what Fleet does.Ted Dorosheff
02/02/2022, 1:02 AM