Dan Achin
03/08/2021, 6:39 PM--enroll_secret_path=
--tls_hostname=
--host_identifier=
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=3600
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=60
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
I'd just like to confirm the recommended approach to do that would be to remove the following settings from our osquery.flags file (and remove the config we are setting at Fleet - the stuff in osquery options / fleetctl get options):
--config_refresh
--config_plugin
--config_tls_endpoint
Anything else?CptOfEvilMinions
03/08/2021, 8:24 PM--logger_plugin
. If you want to send logs/results to Fleet then leave it as is. If you want to store the logs on disk set it to filesystem
or both tls,filesystem
.Dan Achin
03/08/2021, 9:23 PMCptOfEvilMinions
03/08/2021, 9:26 PMDan Achin
03/08/2021, 9:54 PMCptOfEvilMinions
03/08/2021, 10:03 PMDan Achin
03/08/2021, 10:16 PMGavin
03/08/2021, 10:20 PM