If I only set certain keys in my Fleet osquery conf file (e.g.; sysmon.conf), does that remove the current configs for the other keys? I'd like to add

windows_event_channels: 'System,Application,Setup,Security,Microsoft-Windows-Sysmon/Operational'

No, it should only overwrite values that are set.

Should this be working? 🤔 I'm not getting any new

source

in Fleet when I query my host, so I figured I might have done the config wrong.

apiVersion: 1
kind: options
spec:
  config:
    options:
      windows_event_channels: 'System,Application,Setup,Security,Microsoft-Windows-Sysmon/Operational'