NTA Utilization Alert with Top Endpoint, Application Possible?

I have an interface alert for utilization. But wondered if anyone knew how to bring in the top Application , Conversation from the NetFlow data for the interface. 

I currently use a URL link to the interface NTA details page. But SW is integrated with ServiceNow and would be nice to include these details in the ticket raised. 

I have looked at Alert/node variables. But from what I can see. There are no NetFlow variables to facilitate this. 

I did create a NTA Flow alert from the flow navigator to populate the SWQL. But I'm not joining the dots up from the utilization alert to include the Conversation and Application for that interface. 

I have also looked at the Reports in 'Historical NetFlow Reports' for any SWQL that could be used. But I'm not getting anywhere.

Has any body else achieved this?