What info can i get about non-signed software using Network Extensions

Hi, I am working with a Content Filter Network Extension. I was wondering what information i could obtain from an unsigned process that is generating outbound traffic.

Will NEFilterFlows from this process come with a SourceAppAuditToken ?

If so, can i use this to find the location of this process and what command line arguments where used to execute it?

If this is possible how can i do this, i could not find documentation about this.
Thanks.