1. A method for monitoring traffic in a computer network comprising acts of: receiving, by an interface of a flow capture device coupled to the computer network via the network interface, flow information related to network traffic of a plurality of hosts in the computer network; determining, by a flow controller device, similarity between the plurality of hosts in the computer network based on the flow information; calculating similarity values representing the similarity between the plurality of hosts; arranging the hosts into hierarchical clusters based on the similarity values, comprising arranging each of a plurality of entities in a separate cluster and merging the two most similar clusters into a single cluster; selecting at least two of the hierarchical clusters as groups; and creating, by a policy engine, a network access policy for the plurality of hosts in the network based on the flow information, wherein the act of creating a network access policy for the plurality of hosts is performed automatically, and wherein the network access policy is defined at a group level.