My impression is that a lot of folks are running queries on demand or through fleet/kolide, but interested to hear about continuous monitoring/change detection, either through those tools or others, and tooling that up to response.