1. A method comprising: collecting a plurality of indications of compromise from an endpoint, each one of the indications of compromise based upon one or more actions on the endpoint and one or more descriptors and objects related thereto; determining a reputation associated with the plurality of indications of compromise based upon a context for the one or more actions on the endpoint; and creating a rule for evaluating reputation based upon an occurrence of the plurality of indications of compromise.