Brainstorming… You’re trying to detect the negative case, which is often tricky. Can you invert this somewhat? If you have a list of hosts, you could see which ones haven’t checked in. If you had an extension that would write to disk (or maybe an updatable table) you could use that to touch a sentinal file. You could probably also see how the osquery database is different, and poke local disk. (I expect there’s something)