1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising: monitoring data traffic on a network and collecting data access elements thereof; comparing the collected data access elements to security rules providing sets of predefined data access elements for identifying predefined data accesses; sending first audit data collections for data accesses to a first repository and, for a data access that matches a first one of the security rules, sending a second audit data collection defined by the matching first security rule to at least a second repository designated by the matching first security rule; and creating a second security rule automatically in response to the data access matching the first security rule, wherein the second security rule is configured for sending predetermined elements of future data accesses that match the second rule to the second repository, so that when all elements of the data access that matched the first security rule are not present again, the computer-implemented process sends audit data collections for future accesses that match the second security rule to the second repository.