Creating threat analytics on the endpoint