1. A method for creating a rule for tracking user access in a network system, comprising the steps of: recording, by a tracking server, identification of an entry point to the network system; activating an application with a user identification known to the tracking server; tracking, by the tracking server, network transactions associated with the known user identification on the network system; recording, by the tracking server, identification of a connection, associated with the network transactions, between servers; and associating the identification of the connection with the identification of the entry point and an identification of the application.