I’m trying to set up FIM and I’m wondering what are the different ways it can be scoped to hosts? In my current config I have it scoped to 

platforms: darwin

 and this works, like so:

overrides:
    platforms:
      darwin:
        exclude_paths:
          downloads:
            - /Users/%/Downloads/ignore/%%
        file_paths:
          downloads:
            - /Users/%/Downloads/%%

However I want to have another set of paths targeting CentOS. The centos platform definition doesn’t seem to work for whatever reason. Can you scope FIM any other way, such as by label?

at least is this relates to packs: https://osquery.readthedocs.io/en/latest/deployment/configuration/#packs •

darwin

 for macOS hosts •

freebsd

 for FreeBSD hosts •

linux

 for any RedHat or Debian-based hosts •

posix

 for 

darwin

, 

freebsd

, and 

linux

 hosts •

windows

 for any Windows desktop or server hosts •

any

 or 

all

 for all, alternatively no platform key selects all

There also seems to be

debian

,

ubuntu

and

centos

from what I’ve found