Threat-Events™, In-App Threat Intelligence in Kotlin Apps

This knowledge base article shows you how easy it is to use Appdome Threat-Events™ to get in-app threat intelligence in Kotlin Apps and control the user experience in your Kotlin Apps when mobile attacks occur.

What are Threat-Events?

Appdome Threat-Events is a powerful threat-intelligence framework for Android & iOS apps, which is comprised of three elements: (1) a Threat-Event, (2) the data from each Threat-Event, and (3) the Threat-Score™.

With Threat-Events, mobile developers can register, listen to, and consume real-time attack and threat data from Appdome’s mobile app security, anti-fraud, mobile anti-bot, and other protections within their mobile applications. This allows them to (1) ensure that mobile application workflows are aware of attacks and threats, (2) customize business logic and user experience based on the user’s risk profile and/or each attack or threat presented, and (3) pass the threat data to other systems of record such as app servers, mobile fraud analysis systems, SIEMs, and other data collection points.

The purpose of Threat-Events is to enable Android and iOS applications to adapt and respond to mobile app attacks and threats in real-time. Using Threat-Events will ensure you keep users, data, and transactions safe.

Mobile Application Threat-Events vs. Threat-Scores

Appdome Threat-Events can be used as a stand-alone implementation in Kotlin Apps, or in combination with Threat-Scores. Threat-Events provide the mobile developer with the in-app notification of each attack or threat, as well as the metadata associated with the attack. Threat-Scores provide the mobile developer with the Threat-Event event score and the combined (aggregate) mobile end-user risk at the time of the notification.

The figure below shows where you can find Threat-Events and Threat-Scores for each of the runtime mobile app security, anti-fraud, anti-malware, mobile antibot, and other protections available on Appdome:

To enable Threat-Events with any runtime protection, select the check box next to Threat-Events for that feature. Doing so will enable (turn ON) Threat-Events for that feature. To enable Threat-Scores for any runtime protection, click the up/down arrow associated with Threat-Scores to assign a specific score to each protection.
Threat-Scores must have a value greater than zero (0) and less than a thousand (1,000).

Threat-Events and Threat-Scores can be used with or in place of server-based mobile anti-fraud solutions.

Prerequisites for Using Threat-Events with Kotlin Apps

Here’s what you need to use Threat-Events with Kotlin Apps.

• Appdome account (If you do not yet have an account, create a free Appdome account).
• Appdome account class – Appdome DEV or higher.
• Mobile Application Source Code.
• Signing Credentials (e.g., signing certificates and provisioning profile) – see Signing Secure Android apps.

Code Snippet Required for Using Threat-Events with Kotlin Apps

Before consuming Threat-Events or Threat-Scores in your Kotlin Apps, confirm that the following conditions are met:

• Threat-Events and/or Threat-Scores have been enabled ( turned ON) for the specific protection
• You are using the correct identifiers for the Threat-Events for each protection.
  You can find the specific identifiers for each Threat-Event and Threat-Score in the knowledge base article associated with each protection.

Below is the code snippet required for using Threat-Events™ and Threat-Scores™ in Kotlin Apps:

import android.content.BroadcastReceiver
import android.content.Context
import android.content.Intent
import android.content.IntentFilter
import android.os.Build
import android.util.Log

class ThreatEventReceiver(applicationContext: Context) {

    private val TAG = "Appdome ThreatEvent"
    private val threatEvents = arrayOf(
        "BlockedKeyboardEvent",
        "BlockedClipboardEvent",
        "SslCertificateValidationFailed",
        "SslNonSslConnection",
        "SslServerCertificatePinningFailed",
        "UrlWhitelistFailed",
        "SslIncompatibleCipher",
        "SslIncompatibleVersion",
        "SslInvalidCertificateChain",
        "SslInvalidMinRSASignature",
        "SslInvalidMinECCSignature",
        "SslInvalidMinDigest",
        "RootedDevice",
        "AppIntegrityError" // Only available when ONEShield Threat Events are enabled
    )
    private val mContext: Context = applicationContext

    private val receiver = object : BroadcastReceiver() {
        override fun onReceive(context: Context, intent: Intent) {
            onEvent(intent)
        }
    }

    private fun registerReceiverWithFlags(intentFilter: IntentFilter) {
        Log.i(TAG,"REGISTERING: ${intentFilter.getAction(0)}")
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
            mContext.registerReceiver(this.receiver, intentFilter, Context.RECEIVER_NOT_EXPORTED)
        } else {
            mContext.registerReceiver(this.receiver, intentFilter)
        }
    }

    init {
        threatEvents.forEach { event ->
            registerReceiverWithFlags(IntentFilter(event))
        }
    }

    fun onEvent(intent: Intent) {
        val action = intent.action ?: return
        when (action) {
            "BlockedClipboardEvent" -> {
                // "copy", "paste", "cut", "selectAll" or "unknown"
                val clipboardAction = intent.getStringExtra("action") ?: ""
                // "true" or "false"
                val blocked = intent.getStringExtra("blocked") ?: ""
                // message specified in the fusion set
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                // UNIX timestamp of detection
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                // Unique device identifier
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                // Mobile device model
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                // Mobile device OS version
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                // Kernel information
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                // Mobile device manufacturer
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                // Build ID
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                // Carrier identity number (PLMN code)
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                // Device Brand
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                // Device Board
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                // Build Host
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                // Build User
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                // SDK Version
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "BlockedKeyboardEvent" -> {
                // Package name of the keyboard
                val keyboard = intent.getStringExtra("keyboard") ?: ""
                // "true" or "false"
                val blocked = intent.getStringExtra("blocked") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""

                //
                // Respond to mobile app attacks and threats here
                //
            }
            "RootedDevice" -> {
                // Opaque identifier of root detection method
                val internalError = intent.getStringExtra("internalError") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslCertificateValidationFailed" -> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslNonSslConnection" -> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslServerCertificatePinningFailed" -> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslIncompatibleCipher" -> {
                // The Incompatible Cipher Id
                val incompatibleCipherId = intent.getStringExtra("incompatibleCipherId") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslIncompatibleVersion" -> {
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The Incompatible SSL/TLS version
                val incompatibleSslVersion = intent.getStringExtra("incompatibleSslVersion") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslInvalidCertificateChain"-> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "UrlWhitelistFailed"-> {
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslInvalidMinRSASignature"-> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslInvalidMinECCSignature"-> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            "SslInvalidMinDigest"-> {
                // A detailed message describing the detection
                val threatEventDetailedMessage = intent.getStringExtra("DeveventDetailedErrorMessage") ?: ""
                // The host that triggered the detection
                val host = intent.getStringExtra("host") ?: ""
                // The certificate sha1 fingerprint
                val certificateSHA1 = intent.getStringExtra("certificateSHA1") ?: ""
                // The certificate CN (common name)
                val certificateCN = intent.getStringExtra("certificateCN") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            /* Only When ONEShield Threat Events are enabled*/
            "AppIntegrityError" -> {
                // The detected tampered component
                val reason = intent.getStringExtra("reason") ?: ""
                val defaultMessage = intent.getStringExtra("defaultMessage") ?: ""
                val timeStamp = intent.getStringExtra("timestamp") ?: ""
                val deviceID = intent.getStringExtra("deviceID") ?: ""
                val deviceModel = intent.getStringExtra("deviceModel") ?: ""
                val osVersion = intent.getStringExtra("osVersion") ?: ""
                val kernelInfo = intent.getStringExtra("kernelInfo") ?: ""
                val deviceManufacturer = intent.getStringExtra("deviceManufacturer") ?: ""
                val fusedAppToken = intent.getStringExtra("fusedAppToken") ?: ""
                val carrierPlmn = intent.getStringExtra("carrierPlmn") ?: ""
                val deviceBrand = intent.getStringExtra("deviceBrand") ?: ""
                val deviceBoard = intent.getStringExtra("deviceBoard") ?: ""
                val buildHost = intent.getStringExtra("buildHost") ?: ""
                val buildUser = intent.getStringExtra("buildUser") ?: ""
                val sdkVersion = intent.getStringExtra("sdkVersion") ?: ""
                //
                // Respond to mobile app attacks and threats here
                //
            }
            // Add cases for other actions here...
            else -> {
                Log.e(TAG, "Unknown event received: $action")
            }
        }
    }
}

Threat-Event Failsafe Enforcement

Failsafe Enforcement provides app developers with the ability to manage when Appdome enforces specific detections. To utilize this feature, follow the steps below:

1. Set the Threat Event of the selected feature to “In-App Detection” mode.
2. Enable the Threat-Event Failsafe Enforcement option.

Once you have received the Threat Event and performed the necessary internal logic, you should post a notification named “EnforceThreatEvent” using Android’s Broadcast API with the userInfo received from the Threat Event. Below is the code snippet required for using Threat Event in Failsafe Enforcement configuration, with the RootedDevice event as an example:

val action = intent.action

when (action) {
    "RootedDevice" -> {
        //
        // Respond to mobile app attacks and threats here, as seen above
        //

        // Notify Appdome to enforce the Threat Event after Threat Event is handled
        val newIntent = Intent("EnforceThreatEvent").apply {
            putExtras(intent.extras)
        }
        context.sendBroadcast(newIntent)
    }
}

To learn more, please read this article.

Compatibility with Android 14

Following a security update introduced in Android 14 (API level 34), apps targeting Android 14 are required to explicitly specify whether a registered receiver should be exported to all other apps on the device. A SecurityException will be raised if a context-registered broadcast receiver is registered without passing either Context.RECEIVER_NOT_EXPORTED or Context.RECEIVER_EXPORTED. The receiver flags were introduced in Android 13 as part of “Safer exporting of context-registered receivers”, as seen here. Therefore when registering a broadcast receiver for Threat Events, the call to register a a context-registered BroadcastReceiver registration should include the Context.RECEIVER_NOT_EXPORTED receiver flag when the app targeting Android 13 and above in order to ensure that the receiver will only accept broadcasts sent from within the protected app. For additional details, please follow this Android guide.

Meta-Data for Mobile Application Threat-Events and Threat-Scores

Below is the list of metadata that can be associated with each mobile application Threat-Event and Threat-Score in Kotlin Apps.

Some or all of the meta-data for each mobile application Threat-Event and Threat-Score can be consumed in Kotlin Apps at the discretion of the mobile developer and used, in combination with other mobile application data, to adapt the business logic or user experience when one or more attacks or threats are present.

Using Conditional Enforcement for Mobile Application Threat-Events and Threat-Scores

Conditional Enforcement is an extension to Appdome’s mobile application Threat-Event framework. By using conditional enforcement, developers can control when Appdome enforcement of each mobile application protection takes place or invoke backup, failsafe, and enforcement to any in-app enforcement used by the mobile developer.
For more information on using conditional enforcement with your Threat-Event implementation, please contact support@appdome.com.