1. A device configured for machine learning snapshot evaluation, comprising: communication circuitry to interact with at least a remote resource; memory circuitry to store at least learned user behavior; and a machine learning engine to: receive user data associated with the user of the device; generate a snapshot operation of the device, said snapshot to identify at least one active operation in the device and at least one planned operation in the device at the time the snapshot is generated; determine if unusual user behavior has occurred based on a comparison of the snapshot and the learned user behavior, wherein unusual behavior includes an absence of a common active or planned operation or a presence of a new active or planned operation; cause the communication circuitry to transmit the snapshot and the user data to the remote resource responsive to a determination that an unusual user behavior has occurred; determine if the device is new; and transmit at least the snapshot and the user data to the remote resource if it is determined that the device is new; receive threat analysis from the remote resource via the communication circuitry, the threat analysis being received in response to the transmission of the snapshot; determine if a potential threat exists to the device based at least on the threat analysis.