Threat Events in Android & iOS Apps Explained

Developers can use mobile app threat intelligence with Appdome built apps. After you configured the app, it can receive all security alerts when they occur with iOS and Android apps.

This Knowledge Base article reviews in detail how users can use Threat-Events to respond or enforce actions after Appdome detects a security event in a mobile app.

About Appdome Mobile App Threat-Events

Threat-Events use industry-standard notification methods to pass events from the Appdome layer back to the application so that the application can take further action whenever Appdome detects malicious events against an Appdome-protected app.

When a security event is detected by Appdome, the event can be handled in one of the following ways:

• In-App Detection – Appdome detects the attack or threat and passes the event in a standard format to the app for processing (your app chooses how and when to enforce).
• In-App Defense – When a security event is detected by Appdome, Appdome will pass the event from the Appdome layer to the app. Appdome’s security engine will handle the event, the default behavior is for the app to exit after displaying a compromise notification to the end user (compromise notifications are customizable).
• Enforce Connection Only (only for Secure Communication/MitM Attack Prevention and Secure Certificate Pinning) When a security event is detected by Appdome, Appdome will pass the event from the Appdome layer to the app and will block the connection that triggered the event.

By design, when the mobile application registers to receive Appdome Threat-Events, Appdome will send an initial event. If a security event was detected by Appdome during the app launch/run, the initial event will hold the triggered security event details. If no security event was triggered, the initial event will only indicate a successful registration to Appdome’s Threat-Events (the event fields will hold no data).

About Appdome Threat-Event Score

You also can use Appdome Threat-Event Score for advanced threat handling & response. With Threat-Event Score, you can configure each Threat-Event with a unique score in order to value the importance of a particular threat and/or prioritize how threats are handled after Appdome detects a threat.

Risk scoring allows users to get a threat evaluation based on multiple selected Threat Events at a given time. By assigning a risk weight to each Threat Event, you can prioritize the importance of each event in the total risk assessment.

Appdome divides the Threats into two groups: consistent and volatile. Whereas consistent events affect the total score for the entire session of the app, volatile events only affect the total score for a short period of time. Consistent events include root detection and tampering with the app. All other events are considered volatile.

When activating the Threat-Event Score toggle on Appdome, you can set a numerical value (between 1-1000) that you can set for each applicable Threat-Event for any Android or iOS app. This additional scoring attribute is passed as part of an Appdome Threat-Event. Threat-Event Score attributes are persistent (i.e., fixed) in each mobile app build. To update a Threat-Score to reflect a new risk profile for the app or a given threat, you can re-build the app with a new Threat-Event Score on Appdome.

The Threat-Event Score can be set or adjusted according to a user-defined risk model. Threat-Event Scores can be assigned to multiple threats, allowing you to set a threshold for when a security action or workflow will be taken. With Threat-Event Score, developers are enabled to customize the enforcement model and tailor the user experience according to the relative or absolute importance, criticality, or severity level of each threat.

How to Add Threat-Event Score to an Android or iOS App

With Threat-Event turned ON for any applicable feature, turn ON Threat-Event Score and set the Threat-Score to the requested value (1-1000) for each attack or threat.