How to server for incidents (requests) to whitelist sites

I have a list of sites that for one reason or another had been whitelisted in the past and I need to discover who made the requests. I want to search the DLP incidents for the whitelisted site names, and then maybe check from the requester. 

Any idea on the best way to accomplish this?

Thank you for any help.