for live queries? with the current tls api, it’s really up to whatever the polling interval that you configure osquery nodes to check in to the server