{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "aws_kinesis",
    "aws_kinesis_stream": "osquery",
    "aws_region": "us-west-1",
    "aws_access_key_id": "...",
    "aws_secret_access_key": "...",
    "worker_threads": "4",
    "disable_audit": false,
    "audit_allow_config": true,
    "events_expiry": 1,
    "events_max": 2000
  },
  "scheduledQueries": [
    {
      "name": "ops_all_processes",
      "query": "SELECT pid, euid, uid, path, cmdline, parent FROM process_events;",
      "interval": 60
    }
  ]
}