Per-node overrides
An environment’s osquery configuration and flags apply to every node in it. A per-node override changes them for one node without touching the rest. Both overrides are managed by environment admins, from the node detail page or the API, and can carry an expiry (expires_at); an expired override is no longer served.
Configuration override
Section titled “Configuration override”GET, PUT and DELETE on /api/v1/nodes/{env}/node/{uuid}/config. The body of a PUT is {"override": "<json>", "expires_at": null}.
- The override is deep-merged over the environment configuration: objects merge key by key; any other value, arrays included, replaces the environment’s.
- It must be a JSON object. Known sections (such as
options) must be objects, andnullvalues are refused. - Options that control how osquery talks to osctrl are refused, since changing them could cut the host off with no way to undo it from osctrl.
- The
GETresponse shows the environment configuration, the override and the configuration the node is actually served.
Flags override
Section titled “Flags override”GET, PUT and DELETE on /api/v1/nodes/{env}/node/{uuid}/flags. The override is one osquery flag per line; blank lines and # comments are ignored.
- Each override flag replaces every environment line with the same name, in place; flags the environment lacks are appended.
- Flags that control the connection to osctrl (and their
nonegations), repeated flags and an empty override are refused. - A flag that is also a key of
optionsin the environment or node configuration is reported as a conflict, because the same option would be set twice. - Flags reach the host through osctrld, so the node needs osctrld to apply them. The
GETresponse includes the last fetch and the result osctrld reported; those apply fields come from the host and are untrusted.
Deleting a node
Section titled “Deleting a node”osctrl-cli node delete also removes the node’s configuration and flags overrides, osctrld status and extension assignments.