@andrew: I'm not certain this is the question you are asking, but when distributed is enabled, osquery agents periodically check in to see if there are distributed queries for them to run.