How can i apply options to different labels of hosts? Is there a format with all possible fields for fleet options.yaml? I tried to add to my options.yaml. But this applies to all hosts, not specific label
@Noah TalermanCould I set the maximum options in the options.yaml file (include FIM, process_events, etc…), but then on some hosts marked with labels, do not execute, for example, the request
select * from process_file_events
select * from file_events
so the performance on the host cannot be reduced?
04/09/2021, 5:15 PM
osquery will still buffer events if they're enabled.This is a pretty unfortunate limitation of fleet right now (not able to target options to groups of hosts) but should be available... eventually (with Teams).So there's still some overhead if you enable the options but don't enable the queries (e.g., by using labels to target queries you could avoid running those queries on some hosts).
I don't know if this works for you, but you could possibly set all options except those options in fleet, then add those specific options to flag files on hosts where you want to enable process / file events.