We have heartbeat queries, that run roughly once every 5-10 minutes, which gives us a good idea of how many hosts we should expect and "trends", and then just look for deviations from those trennds