Gregory Storme

03/09/2022, 9:43 AM
Hi, I've added
disable_carver: true
in the global agent options, but I don't see this being changed on the orbit/osquery daemon They are still running with the
flag How is such a change to the global agent options reflected on the hosts?
👀 1

Michal Nicpon

03/09/2022, 10:39 PM
Is the host assigned to a team? If yes, can you check that the agent options for the team by going to Settings -> Teams -> Agent options and checking that
is not set.
My mistake,
is a cli flag, and is not set via agent options. You need to set it in the osquery flagfile or pass at directly when starting osquery