For Android, detect Linked Devices by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Field | Description |
|---|---|
| MessagingAppList | org.thoughtcrime.securesms (Signal), com.whatsapp, com.whatsapp.w4b. |
| DeviceLinkAPIEndpoints | /v1/devices, /v1/provisioning, /linked — Signal and WhatsApp device registration URI patterns. |
| QRLinkWindow | Default 30s between camera activation and device link PUT — QR scan to registration is near-instantaneous. |
| SyncVolumeThreshold | Default 5MB — message history sync is significantly larger than normal registration. |
| SyncWindow | Default 120s after device link PUT. |
For iOS, detect Linked Devices by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Permissions Request (DC0116) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Field | Description |
|---|---|
| MessagingBundleIDs | org.whispersystems.signal, net.whatsapp.WhatsApp. |
| DeviceLinkAPIEndpoints | /v1/devices, /v1/provisioning URI patterns for Signal and WhatsApp. Update from platform API documentation. |
| QRLinkWindow | Default 30s between camera activation and device-link PUT — human QR scan-to-submit timing. Tightening: 15s. |
| SyncVolumeThreshold | Default 5MB — message history sync is large relative to registration overhead. |
| SyncWindow | Default 120s after device-link PUT. |