1. A system, comprising: a processor configured to: receive a rule to be applied to network traffic associated with members of a dynamic address group; receive virtual machine information associated with a first virtual machine instance executing on a host machine; determine, based at least in part on at least a portion of the received virtual machine information, that the first virtual machine instance belongs to the dynamic address group; and in response to the determination, apply the rule to network traffic associated with the first virtual machine instance; and a memory coupled to the processor and configured to provide the processor with instructions.