For Android, detect Compromise Hardware Supply Chain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between enrollment/posture anomaly, privileged capability use, and network egress. |
| AllowedOEMComponents | Approved system identities, preload packages, and OEM services differ by model and fleet. |
| AllowedDestinations | OEM update, activation, MDM, and enterprise service destinations vary by environment. |
| ForegroundStateRequired | Some protected resource access may be legitimate only when the app is foregrounded. |
| RecentUserInteractionWindow | Defines how close resource access must be to user interaction to be considered expected. |
| EnrollmentGracePeriod | Initial setup/update behavior may generate benign network or configuration drift for a short period. |
| UplinkBytesThreshold | Size threshold for suspicious outbound transfer from a device in abnormal posture. |
| ApprovedImageBaseline | Known-good build fingerprint, patch, boot state, and baseband combinations vary by device fleet. |
For iOS, detect Compromise Hardware Supply Chain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between enrollment/inventory concern and suspicious network activity. |
| SupervisedRequired | Most strong posture and inventory analytics require supervised iOS devices. |
| AllowedDestinations | Apple, MDM, update, enterprise, and managed SaaS destinations vary by organization. |
| BackgroundRefreshBaseline | Expected background network behavior varies by managed app set and policy. |
| ActivationGracePeriod | Benign activation, restore, and setup traffic can be noisy immediately after provisioning. |
| RecentUserInteractionWindow | Defines how recently the user must have interacted for activity to be considered expected. |
| InventoryDriftTolerance | Tuning for acceptable changes in inventory/configuration during upgrades or replacements. |