osquery.conf

{
  "options": {
    "host_identifier": "hostname",
    "schedule_splay_percent": 10,
    "verbose": true
  },
  "schedule": {
    "distinct_users": {
      "query": "select distinct user from logged_in_users where user is not '';",
      "interval": 60
    },
    "most_mem_usage_10": {
      "query": "select pid, name from processes order by phys_footprint desc limit 10;",
      "interval": 60
    },
    "live_kernel_mod": {
      "query": "select name, size, used_by, address from kernel_modules where status='Live';",
      "interval": 120
    },
    "arp_cache": {
      "query": "select * from arp_cache;",
      "interval": 120
    },
    "network_interface_details": {
      "query": "select * from interface_details;",
      "interval": 30,
      "removed": false
    }
  }
}