Thanks for the clarification, that helps a lot. For our use case (per-process connection metadata: process identity, destination IP/port, timestamps, no payload inspection), would a Network Extension content filter (NEFilterDataProvider) be the recommended approach? Specifically, can NEFilterFlow provide reliable process attribution + connection metadata without requiring full traffic interception? Our deployment is strictly MDM-managed enterprise devices.