According to examples, an apparatus may include a memory on which is stored instructions that when executed by a processor, cause the processor to extract, from network traffic data, a connectivity matrix that identifies connectivity data between entities and group the entities into a plurality of clusters based on the extracted connectivity matrix. The processor may also, for each cluster of the plurality of clusters, identify at least one representative entity that is to represent the entities in the cluster and output the identified at least one representative entity for identification of group behaviors of the entities in the plurality of clusters, in which the identified group behaviors are to be used for information technology management.