From cf9146eea20ccf5a1314fcea184a9a242f6a9f12 Mon Sep 17 00:00:00 2001 From: noahtalerman <47070608+noahtalerman@users.noreply.github.com> Date: Mon, 4 Jan 2021 13:55:43 -0800 Subject: [PATCH] Add additional documentation on how the osquery configuration overrides option works. (#163) - Quick attempt to alleviate potential confusion for how the osquery configuration overrides option works - Leave in the commented explanation in the sample yaml file --- docs/1-Using-Fleet/2-fleetctl-CLI.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/1-Using-Fleet/2-fleetctl-CLI.md b/docs/1-Using-Fleet/2-fleetctl-CLI.md index 6e4aa024f4..ef9d8b9813 100644 --- a/docs/1-Using-Fleet/2-fleetctl-CLI.md +++ b/docs/1-Using-Fleet/2-fleetctl-CLI.md @@ -386,6 +386,12 @@ spec: The following file describes options returned to osqueryd when it checks for configuration. See the [osquery documentation](https://osquery.readthedocs.io/en/stable/deployment/configuration/#options) for the available options. Existing options will be over-written by the application of this file. +#### Overrides option + +The overrides option allows you to segment hosts, by their platform, and supply these groups with unique osquery configuration options. When you choose to use the overrides option for a specific platform, all options specified in the default configuration will be ignored for that platform. + +In the example file below, all Darwin and Ubuntu hosts will only receive the options specified in their respective overrides sections. + ```yaml apiVersion: v1 kind: options