1. A computer implemented method of monitoring instant message (IM) traffic at a node on a network, comprising: detecting video content in the IM traffic at the node; performing a facial recognition analysis on the video content to extract an image having human facial features; extracting a user identity from the IM traffic; associating the image having human facial features with the user identity to provide a visual identification for the user identity; sending an alert message having the associated image and the user identity to a pre-defined address; and storing the associated image and the user identity in a log implemented in a memory on the network.