Another question, can we remove some query from denylist using Fleet?

osquery_scheduled

returned denylisted=1 for query, but without any hardware utilization metrics. In my opinion, it looks like mismatch. Is it a way to remove this special query from denylist without direct access to client laptop and not to wait 24 hours?

Yes, you can set

denylist: false

in the yaml when scheduling the query. See https://osquery.readthedocs.io/en/stable/deployment/configuration/#schedule.

@zwass thank you for answer! I’ve read this doc, but I’ve not found same functionality in Fleet UI. Also found feature request https://github.com/kolide/fleet/issues/2335. Is that correct, that Fleet UI doesn’t have this feature yet?

Yes, you are correct. If this is important for you in the UI please open a feature request in fleetdm/fleet. I think we can support it without too much trouble.

Got it, thanks again!