1. A method, comprising: identifying a root term from at least one of search results, one or more incident lists, or user-provided input; determining one or more other terms belonging to a group associated with the root term; selecting one or more of the terms from the group; converting the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept; indexing a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored; applying a concept based on the selected terms to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags; and quarantining at least some of the network traffic based on the rule.