@Matt Brown - thanks for asking thoughtful questions and making your own observations as it allows others to highlight the value of osquery in production use cases. Regarding arbitrary polling, you may be aware of this, however osquery has an interesting trait wrt to using HTTP/TLS connectivity - i.e. it behaves like a web browser and connects outbound and connects to a backend. This makes it very firewall friendly and helpful for ZTN visibility use cases. This is probably the opposite of most windows based implementation where the server connects to the agent for ask questions. Perhaps this might the similar to your experience with DSC scripting or PS scripting - i.e. you have connect to machine and launch the script etc and then push the locally generated logs to splunk. Osquery on the other hand can be configured to work exactly the opposite and it connects over HTTP/TLS and using REST semantics. It accepts query/work from a backend (http read endpoints) and posts the response back to the backend (http write endpoints). The same is the case for events and schedule queries (differential and snapshot). As you are thinking through the issues/PoC, this should potentially allow you to implement your desire of reduced agents and boring tech on the actual endpoint.