1. A method comprising: receiving a plurality of capture rules used to determine whether intercepted objects are to be stored; for each received rule, constructing a state table chain configured to parse a tag for the rule; generating a state table tree using the plurality of state table chains, the state table tree being configured to parse the tag for the plurality of capture rules; and intercepting packets being transmitted on a network, the packets associated with a document that includes the intercepted objects, wherein the document is captured based on a particular capture rule associated with the intercepted objects, and wherein the tag comprises a data structure containing meta-data associated with a particular intercepted object, and wherein the document is stored in response to traversing the state table tree to parse the tag and match the tag to the particular capture rule.