http://www.mcafee.com/us/resources/data-sheets/ds-network-user-behavior-analysis.pdf
is a Mc affee development for this analysis.
CCNA3 only touches this subject and describes it as a proces rather then a software package (I think... it's not really clear).
It gives you a brief description of this process but that's all. (I am taking my exame 15 of march)
Due to a history in companies user groups just do exist and you can try to direct your flow analysis using this.
I have, however, no experience in this subject, I just did some research since I was stuck with the same questions, doing my CCNA3.