Hey guys, how can I build an Orbit package with custom OSQuery flagfiles? I was expecting that I could pass in the flagfiles when I'm building the Orbit package, but I'm not seeing any command line argument that accepts flagfiles. Was checking the file here - https://github.com/fleetdm/orbit/blob/main/cmd/package/package.go The use case that I'm thinking is that I want to disable certain OSQuery tables on the clients with the

--disable_tables

such that the Fleet users cannot abuse the live query functionality to query potentially sensitive OSQuery tables.

Good point. Orbit currently takes arbitrary osquery flags when running the binary, but we need to add it to the package tooling. Can you please file an issue with this request and we'll make sure it gets in for the stable release?

Thank you, I raised https://github.com/fleetdm/fleet/issues/907

I do not know if this is addressed yet, but the way I found to do it is doing an override by platform. Set my Osquery Flags in the override. When Orbit Connects it pulls those flag files.