For Android, detect Stored Application Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| File Access (DC0055) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777 |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| HighValueAppList | Banking, email, authenticator, messaging app packages. Derive from MDM app catalog by data-sensitivity tier. |
| ApprovedStorageReaders | Media players, file managers, MDM agent. Derive from MDM catalog. |
| UplinkThreshold | Default 500KB. Tightening: 100KB. Derive from per-app upload baseline. |
| AppCDNList | Per-app known upload destinations. Derive by measurement. |
| ExfilWindow | Default 120s. |
For iOS, detect Stored Application Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Host Status (DC0018) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| HighValueAppList | Banking, authentication, enterprise email, cryptocurrency wallet bundle IDs. Derive from MDM app catalog by data-sensitivity tier. |
| DataDumpMin | Default 50KB — minimum for meaningful app database content. |
| DataDumpMax | Default 10MB — cap to exclude media exfil which is larger. |
| AppCDNList | Per-device CDN baseline, 30-day. |
| ExfilWindow | Default 300s after jailbreak detection. |