1. A method comprising: receiving a plurality of capture rules used to determine whether intercepted objects are to be stored; for each received rule, constructing a state table chain configured to parse a tag for the rule; and generating a state table tree using the plurality of state table chains, the state table tree being configured to parse the tag for the plurality of capture rules.