1. A method comprising: receiving, at an endpoint device of a network, a traffic analysis query from a network controller, the traffic analysis query including one or more query parameters, wherein the one or more query parameters are provided to select portions of traffic analysis data; identifying a portion of traffic analysis data stored in a buffer that satisfies the one or more query parameters, wherein the traffic analysis data characterizes traffic data that has traversed the endpoint device, and wherein the endpoint device provides network access to one or more client devices; and providing the identified portion of the traffic analysis data to the network controller in response to the traffic analysis query.