I have a lot of events coming through where snapshot[] is just empty

An empty result is a valid answer though, otherwise how do you know the result was zero rows vs the host never responded?

that is a fair point, so if I understand you correctly, if snapshot == [], then the host is just offline or they responded with an empty result?

empty results just mean zero rows returned from the osquery query. I think that is a valuable piece of data

That makes sense

Fleet mechanizes this property of zero result queries as Policies. Those can be quite useful.