1. A method comprising: detecting a request for network traffic at a gateway associated with an enterprise managed by a threat management facility, the request including a destination address and the request containing a violation of a network policy for the enterprise; identifying an endpoint coupled to the gateway that originated the request; querying the endpoint to determine a source of the request; locating the source on one or more other endpoints managed by the threat management facility; and remediating the one or more other endpoints.