Hi Everyone, I am facing an issue where I can't retrieve the scheduled query results through my /api/logs endpoint which is in python and I am using ngrok to serve a HTTPS server. Here is the flags file -

# Server Configuration

--tls_hostname=<http://xxxx.ngrok-free.dev|xxxx.ngrok-free.dev>

# Enrollment Configuration

--enroll_tls_endpoint=/api/enroll

--enroll_secret_path=C:\osquery_certs\enrollment_secret.txt

--disable_enrollment=false

# Config Plugin

--config_plugin=tls

--config_tls_endpoint=/api/config

--config_tls_refresh=60

--config_tls_max_attempts=3

# Logger Configuration

--disable_logging=false

--logger_plugin=tls

--logger_tls_endpoint=/api/logs

--logger_tls_period=5

--logger_event_type=true

--logger_min_status=0

# Device Identification

--host_identifier=uuid

# Verbose logging for testing

--verbose=true

--logger_min_status=0

--allow_unsafe

--force

--tls_dump

--enable_ntfs_event_publisher=true

--enable_process_etw_events=true

--enable_windows_events_publisher=true

--enable_windows_events_subscriber=true

--disable_events=false

--disable_database=false

Please someone guide me what am I doing wrong? this is the config which I am sending back to the config api response -

@app.route('/api/config', methods=['POST'])

def config():

"""Provide osquery configuration"""

data = request.get_json()

node_key = data.get('node_key', '')

print(f"\n[CONFIG] Request from node_key: {node_key}")

if node_key not in enrolled_nodes:

print(f"[CONFIG] FAILED - Unknown node_key")

return jsonify({"node_invalid": True}), 401

# Simple config with one query

osquery_config = {

"schedule": {

"os_version": {

"query": "SELECT * FROM os_version;",

"interval": 10

},

}

}

print(f"[CONFIG] Sending configuration")

return osquery_config