For Android, detect Application Versioning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Permissions Request (DC0116) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Field | Description |
|---|---|
| PermissionDeltaAllowList | Expected permission additions per app per planned update. Derived from app developer changelog and IT review. |
| AppBaselineDomains | Pre-update network domain baseline per app. Anchor to prior version. Derive by measurement. |
| PostUpdateWindow | Default 86400s (24hr) post-update behavioral window. Tightening: 3600s. |
For iOS, detect Application Versioning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Permissions Request (DC0116) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Field | Description |
|---|---|
| PermissionDeltaAllowList | Expected privacy permission additions per planned update. Derived from IT app review. |
| AppBaselineDomains | Pre-update domain baseline anchored to prior version. |
| PostUpdateWindow | Default 86400s. Tightening: 3600s. |