From 071e7c75f15323bafb785140b062ff1976990190 Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Date: Fri, 12 Sep 2025 20:28:18 -0500
Subject: [PATCH] Fix agent options for darwin overrides -- all options must be
 set in overrides. (#32945)

---
 it-and-security/teams/workstations-canary.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 79a89f128a..815b62132d 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -38,6 +38,18 @@ agent_options:
   overrides:
     platforms:
       darwin:
+        decorators:
+          load:
+            - SELECT uuid AS host_uuid FROM system_info;
+            - SELECT hostname AS hostname FROM system_info;
+        options:
+          disable_distributed: false
+          distributed_interval: 10
+          distributed_plugin: tls
+          distributed_tls_max_attempts: 3
+          logger_tls_endpoint: /api/osquery/log
+          logger_tls_period: 10
+          pack_delimiter: /
         auto_table_construction:
           tcc_system:
             path: /Library/Application Support/com.apple.TCC/TCC.db