1. A system, comprising: a processor configured to: receive, from a first server comprising an instant messaging server and internal to a first network, event data generated in response to a device exchanging communications with the first server, wherein the event data includes a username associated with a user of the device, wherein an authentication of the device is performed by the first server, wherein the authentication is performed at least in part by the first server contacting a directory server using the first network, and wherein the first server is different from the directory server; use, at a security appliance, the received event data to associate the username and an IP address of the device into a mapping; receive, at the security appliance, from the device, a request to access a second server that is external to the first network; determine a policy to apply to communications exchanged between the device and the second server based at least in part on the mapping; and apply the policy to at least one of the device and the second server, wherein applying the policy includes permitting communications between the device and the second server only in the event it is determined that the user is associated with an approved group object, and wherein the approved group object comprises a plurality of devices as members; and a memory coupled to the processor and configured to provide the processor with instructions.