it requires installation of osquery on the endpoint, so osqueryd would need to run, but you can use kolide to schedule ad hoc queries across all your infrastructure. head over to #C1XCLA5DZ if you are interested. They are super helpful