Do ATC tables work in Fleet? Running

select value from osquery_flags where name='config_path'

gives

/var/osquery/custom_tables.json

Which I’ve attached. This works when run locally with osqueryi, but does not work when run via the Fleet interface:

select * from quarantine_items LIMIT 1;

Is there something I’m missing?

You likely have osquery configured to use the

tls

config plugin. This means it won't read any config off disk. You should try adding your atc entries to the config Fleet serves.

Ahh that makes sense!