Hello! I would like to setup Mac (darwin) File Integrity Monitoring and because of that I changed the Agent options in fleet to this:

config:
  options:
    pack_delimiter: /
    logger_tls_period: 10
    distributed_plugin: tls
    disable_distributed: false
    logger_tls_endpoint: /api/osquery/log
    distributed_interval: 10
    distributed_tls_max_attempts: 3
  decorators:
    load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
overrides:
  platforms:
    darwin:
      options:
        disable_audit: false
        disable_events: false
      file_paths:
        etc:
          - /etc/%%
        homes:
          - /Volumes/%%
        users:
          - /Users/%/Library/%%
          - /Users/%/Documents/%%
command_line_flags: {} # requires Fleet's osquery installer

you might wanna check file_events and make sure that osqueryd has full disk access perms on macbooks

A good way to check if permissions are the issue is to test the query locally with

sudo orbit osqueryd

.