👋 Have a hopefully simple question for folks more knowledgeable than I am -- I have an ask to enable a couple features (

--enable_file_events=true

and

--disable_audit=false

) in osquery from our security team. Trying to understand if this is something that can be applied via MDM config profile for macOS/Windows clients (we use Jamf), or if this is something I can script and add to the launchdaemon? Little unfamiliar with the tool, so apologies for the odd ask thanks

most likely (more than likely?) you are using a config file to which you would add these arguments. also possible but less likely you are passing these config switches via cli, in this case you would update that to include the switches.

Oh interesting - so this is something that's actually set from the fleet portal rather than applied to endpoints via MDM?

Huh okay let me follow up with them - I don't currently have access to our fleet portal. I'm assuming this is also where we'd specify paths to monitor file events for as well.