Interesting that osquery is developed by Facebook and Santa is developed by Google. I do some work with Facebook and during a video conference with one of their employees the connection dropped out. When we reconnected I asked what happened and they said that the machine updated itself. I thought this was kind of an odd time to update and dropped it into the conversation and was told that their laptops are updated every day. Without an understanding of the inner workings of Facebook it seems like they may be snapshotting employee machines, daily.