I see that I can modify

osquery.flags

in the orbit root, but is there documentation for what flags are set by default by Orbit?

I use this query to check for flags set and their default value.

SELECT * FROM osquery_flags

However, I do not see a eBPF flag in my environment today. Maybe you refer to

enable_bpf_events

flag?

yes thats the tag