1. A method implemented and residing within a computer-readable storage medium that is executed by one or more processors of a network to perform the method, comprising: gathering data from a plurality of disparate sources and disparate locations over a network at predefined time intervals, the network is a combination of the Internet and selective Intranets, and the data gathered from emails, Simple Network Management Protocol (SNMP) histories, operating system logs, Instant Message histories, system logs, directories, web portals, data produced by applications/services, text message histories, histories on social networking websites, Application Programming Interface (API) generated data, and event streams; filtering and then normalizing the data to get modified data; creating relationships between elements of the modified data to establish structured data; correlating components of the structured data to establish correlated data based at least in part on a reputation concerning a geographic location associated with the data, an individual identity associated with the data, and a group identity associated with the data and correlating components of the structured data to establish the correlated data based at least in part on temporal correlation patterns; tagging pieces of the correlated data to create tagged data based on tagging patterns; inserting a tag addendum into the correlated data as a tagging instruction for subsequent investigation as a potential new tag for inclusion in the tagging patterns, wherein the tag addendum does not alter evaluation of the correlated data; merging portions of the tagged data with other previously tagged data to provide a distributed knowledge store; and distributing the method processing over multiple network machines and distributing the distributed knowledge store over the network.