On managed Android devices with the necessary network and security telemetry enabled, identify an application package retrieved through a browser, messaging application, third-party store, or another external delivery mechanism. Correlate the package retrieval with a subsequent installation event on the same device, using package identity, delivery source, timing, and installer provenance where available.
Prioritize cases where the delivery source is outside approved distribution channels, the installer is inconsistent with authorized workflows, and the application is not approved for the device or user. Exclude sanctioned enterprise deployments, approved testing, and documented alternative distribution channels.
| Data Component | Name | Channel |
|---|---|---|
| Network Communication (DC0113) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Network Traffic Content (DC0085) | VPN:MobileProxy | Inspected HTTP transaction showing APK/package retrieval, including URL, response content type, or validated payload type |
| File Creation (DC0039) | MobileEDR:telemetry | Monitored creation of an APK or application-package staging artifact following external retrieval |
| System Settings (DC0118) | android:DevicePolicyManager | Managed security state and policy information, including supported installation-related settings |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Field | Description |
|---|---|
| ApprovedDistributionSources | Authorized application stores, enterprise distribution services, and approved third-party application repositories. |
| ApprovedInstallerPackages | Package identifiers of trusted applications permitted to initiate package installation, including approved stores and enterprise deployment agents. |
| ApprovedApplicationPackages | Application package identifiers authorized for installation on managed devices. |
| ApprovedDeliveryDomains | Domains and endpoints permitted to distribute APK files or other supported Android application packages. |
| DeliveryCorrelationWindow | Maximum time between an observed package download or delivery event and a corresponding installation event. |
| PackageIdentityMatchRequired | Whether delivery-to-installation correlation requires matching package identifiers, hashes, or other available package attributes. |
| AllowedInstallSourceTypes | Permitted installation-source classifications, where the Android version and collection mechanism expose them. |
| ApprovedSigningCertificates | Trusted signing-certificate fingerprints used to distinguish authorized application packages from unexpected or modified packages. |
| AllowedInstallationExceptions | Documented exceptions for enterprise sideloading, developer testing, device provisioning, and approved alternative distribution workflows. |
| MonitoredDeliveryChannels | Browser downloads, messaging applications, email attachments, third-party stores, and other delivery mechanisms covered by available telemetry. |
| MinimumDeliveryEvidence | Required evidence to establish package delivery, such as a validated APK retrieval, observed package-file creation, or equivalent artifact. |
| MinimumCorrelationConfidence | Minimum combination of package identity, installer provenance, device identity, and timing required to associate delivery with installation. |
On managed iOS devices, identify observable delivery of an application package or distribution link through an external website, messaging channel, or other non-approved distribution mechanism.
Where managed network inspection exposes the transaction, identify application-package retrieval or a distribution workflow outside the organization's approved channels. Correlate this with an application newly appearing in device inventory or with a managed-app lifecycle change, using bundle identifier, distribution attributes, and timing where available.
Prioritize cases where the distribution evidence is independently observed and inconsistent with authorized enterprise distribution, alternative marketplaces, or approved testing workflows.
| Data Component | Name | Channel |
|---|---|---|
| Network Communication (DC0113) | iOS:NetworkExtension | NEFilterFlow, per-app VPN, or secure web gateway flow metadata |
| Network Traffic Content (DC0085) | VPN:MobileProxy | Inspected application-package retrieval transaction, where authorized content inspection exposes the URL, response, or package type |
| Application State (DC0123) | iOS:MDM | Declarative Management app.managed.list status changes, where collected |
| iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Field | Description |
|---|---|
| ApprovedDistributionSources | Authorized App Store distribution, enterprise application distribution, and permitted alternative distribution mechanisms applicable to the device and region. |
| ApprovedApplicationBundleIDs | Bundle identifiers of applications authorized for the managed device or organizational role. |
| ApprovedDistributionDomains | Domains and endpoints permitted to distribute application packages, installation manifests, or other application-delivery artifacts. |
| ApprovedEnterpriseDevelopers | Authorized enterprise signing identities and development teams, where signing provenance is available to the collection source. |
| ApprovedAlternativeMarketplaces | Authorized alternative application marketplaces, where supported by the device's OS version and jurisdiction. |
| MonitoredDeliveryChannels | Email, messaging, web browsing, managed network inspection, and enterprise distribution workflows with available delivery telemetry. |
| DistributionArtifactTypes | Application packages, installation manifests, marketplace distribution links, and other supported delivery artifacts that the analytic can reliably identify. |
| DeliveryCorrelationWindow | Maximum interval between observed application-delivery activity and a related application-state change. |
| InventoryObservationInterval | Expected interval between managed-device application inventory observations, accounting for polling and reporting delays. |
| ManagedApplicationStatusTypes | Managed-app lifecycle states or status changes used to establish application installation or deployment outcomes. |
| AllowedDistributionExceptions | Approved enterprise deployments, development builds, TestFlight testing, regional alternative distribution, and other sanctioned workflows. |
| MinimumDeliveryEvidence | Required network or distribution evidence to establish that an application was delivered through a particular mechanism. |
| MinimumCorrelationConfidence | Minimum combination of bundle identity, distribution evidence, device identity, and timing required to correlate delivery with an observed application-state change. |