Question irt

/settings/osquery

web endpoint... Does a system check config everytime it sends data or do you have to configure this somewhere? Currently, we do change control of osquery configuration outside of fleet and if this works as I imaging then I can just have this be the source of truth for all osquery deployments in my environment.

Does a system check config everytime it sends data or do you have to configure this somewhere?

By default, configuration is fetched only at osquery load. Check out the

--config_refresh

osquery flag to have the system check for new config on a regular interval.