16. Logic encoded in non-transitory media for execution and when executed by a processor operable to: identify a root term from at least one of search results, one or more incident lists, or user-provided input; determine one or more other terms belonging to a group associated with the root term; select one or more of the terms from the group; convert the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept; index a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored; apply a concept based on the selected terms to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags to determine if any of the selected terms occur in the document; and quarantine at least some of the network traffic based on the rule.
16. Logic encoded in non-transitory media for execution and when executed by a processor operable to: identify a root term from at least one of search results, one or more incident lists, or user-provided input; determine one or more other terms belonging to a group associated with the root term; select one or more of the terms from the group; convert the selected terms to regular expressions that are mapped to attributes according to an attribute map, wherein the attributes are associated with a concept; index a document using tags stored in a tag database, wherein if a predetermined number of the regular expressions occur in the document, the tags are associated with corresponding attributes by setting a field or position in an index in the tags where each corresponding attribute has a separate field in the tag indicating whether the attribute is present in the document, and wherein the tags include a pointer to a storage location where the document is stored; apply a concept based on the selected terms to a rule provided as part of a security policy that controls whether the document is permitted to be sent to a next destination as part of network traffic, wherein the rule is applied to the tags to determine if any of the selected terms occur in the document; and quarantine at least some of the network traffic based on the rule. 18. The logic of claim 16 , wherein the determining of the other terms includes identifying parameters associated with distance and frequency associated with the other terms.