1. A computerized method to identify potentially malicious code at an endpoint device in a network, the method comprising: analyzing a portion of the network data received over the network to identify one or more threats represented by the network data; generating a report by a threat monitor, the report includes information on the one or more threats resulting from the analyzing of the portion of the network data; analyzing the information within the report by a verifier to yield intelligence that includes at least one of instructions or indicators related to the identified one or more threats and determining, based on the intelligence yielded from the information within the report, an endpoint device including an endpoint agent that is to (i) receive at least one of the instructions or the indicators, (ii) conduct an examination of memory of the endpoint for data corresponding to any of the instructions or the indicators, and (iii) obtain results of the examination; gathering and correlating verification information from the endpoint agent to determine whether the verification information corresponds to a verified threat, the verification information includes at least a portion of the results of the examination and an identifier for the endpoint device; and sending a notification including a portion of the verification information to identify the verified threat.