For Android, detect Impersonate SS7 Nodes by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Communication via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Network Communication (DC0113) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| LegitimateRoamingPartners | Carrier-maintained verified roaming partner GT/PC list. |
| MonitoredMSISDNList | Enterprise employee MSISDN list for targeted monitoring. Derive from HR. |
| SS7QueryThreshold | Default 3 queries for same MSISDN within window. |
| SS7QueryWindow | Default 3600s. |
For iOS, detect Impersonate SS7 Nodes by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Communication via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Network Communication (DC0113) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| LegitimateRoamingPartners | Same carrier roaming partner list. |
| SS7QueryThreshold | Default 3 queries. |
| SS7QueryWindow | Default 3600s. |