Outbound network traffic originating from a client computer is monitored, and requests to access URLs in the outbound network traffic are detected. Detected requests to access URLs are compared to each of a plurality of rules, in order to determine whether specific ones of the detected requests were initiated automatically by a process or manually by a human user. Where a rule of the plurality applies to a detected request, a rating concerning the request is adjusted. The rating indicates a likelihood as to whether the request was initiated automatically or manually. Depending upon whether the rating concerning the request reaches a threshold, the request is categorized as being either automatically initiated by a process, or manually initiated by a human user. Only those requests categorized as being manually initiated by a human user are logged.