Packetbeat has a nifty process monitor that can track flows even down to between processes running on the same server:
- process: mysqld
Unfortunately it is Linux only. Now I do know that later versions of Windows have a handy -o switch for netstat that shows the process number assigned to the port. Would it be feasible to capture this to mimic the Linux process flow functionality?