For Android, detect Call Log by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$ |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Permissions Request (DC0116) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Field | Description |
|---|---|
| ApprovedDialerApps | Default dialer, approved call backup apps. Minimal. |
| CallLogQueryThreshold | Default 10 queries/2min — low threshold; call log has minimal legitimate background access. |
| CallLogUplinkThreshold | Default 20KB — call records are small; even 200 records fit in ~20KB. |
| AppCDNList | Per-app CDN. Derive by measurement. |
| ExfilWindow | Default 120s. |
For iOS, detect Call Log by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Host Status (DC0018) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| CommunicationAppList | Phone, FaceTime, WhatsApp, Signal — apps that generate call history. |
| CallLogDumpMin | Default 5KB. |
| CallLogDumpMax | Default 1MB — call records are small; this is generous. |
| AppCDNList | Per-device CDN baseline. |
| ExfilWindow | Default 300s. |