1. One or more non-transitory machine-readable storage media that includes code for execution and when executed by a processor is operable to perform operations comprising: receiving a plurality of parameters based, at least in part, on metadata information obtained from data mining one or more databases, at least one database containing tags associated with objects, wherein the data mining is to apply one or more filters to the tags of the at least one database to obtain at least a portion of the metadata information; creating a rule associated with at least some of the parameters; and incorporating the rule into a security policy to be used by a capture system, wherein the security policy is to control network communications captured by the capture system.