Threat-Events™, In-App Threat Intelligence in Swift Apps

This knowledge base article shows you how easy it is to use Appdome Threat-Events™ to get in-app threat intelligence in Swift Apps and control the user experience in your Swift Apps when mobile attacks occur.

What are Threat-Events?

Appdome Threat-Events is a powerful threat-intelligence framework for Android & iOS apps, which is comprised of three elements: (1) a Threat-Event, (2) the data from each Threat-Event, and (3) the Threat-Score™.

With Threat-Events, mobile developers can register, listen to, and consume real-time attack and threat data from Appdome’s mobile app security, anti-fraud, mobile anti-bot, and other protections within their mobile applications. This allows them to (1) ensure that mobile application workflows are aware of attacks and threats, (2) customize business logic and user experience based on the user’s risk profile and/or each attack or threat presented, and (3) pass the threat data to other systems of record such as app servers, mobile fraud analysis systems, SIEMs, and other data collection points.

The purpose of Threat-Events is to enable Android and iOS applications to adapt and respond to mobile app attacks and threats in real-time. Using Threat-Events will ensure you keep users, data, and transactions safe.

Mobile Application Threat-Events vs. Threat-Scores

Appdome Threat-Events can be used as a stand-alone implementation in Swift Apps, or in combination with Threat-Scores. Threat-Events provide the mobile developer with the in-app notification of each attack or threat, as well as the metadata associated with the attack. Threat-Scores provide the mobile developer with the Threat-Event event score and the combined (aggregate) mobile end-user risk at the time of the notification.

The figure below shows where you can find Threat-Events and Threat-Scores for each of the runtime

To enable Threat-Events with any runtime protection, select the check box next to Threat-Events for that feature. Doing so will enable (turn ON) Threat-Events for that feature. To enable Threat-Scores for any runtime protection, click the up/down arrow associated with Threat-Scores to assign a specific score to each protection.
Threat-Scores must have a value greater than zero (0) and less than a thousand (1,000).

Threat-Events and Threat-Scores can be used with or in place of server-based mobile anti-fraud solutions.

Prerequisites for Using Threat-Events with Swift Apps

Here’s what you need to use Threat-Events with Swift Apps.

• Appdome account (If you do not yet have an account, create a free Appdome account).
• Appdome account class – Appdome DEV or higher.
• Mobile Application Source Code.
• Signing Credentials (e.g., signing certificates and provisioning profile) – see Signing Secure iOS apps.

Code Snippet Required for Using Threat-Events with Swift Apps

Before consuming Threat-Events or Threat-Scores in your Swift Apps, confirm that the following conditions are met:

• Threat-Events and/or Threat-Scores have been enabled ( turned ON) for the specific protection
• You are using the correct identifiers for the Threat-Events for each protection.
  You can find the specific identifiers for each Threat-Event and Threat-Score in the knowledge base article associated with each protection.

Below is the code snippet required for using Threat-Events™ and Threat-Scores™ in Swift Apps:

let center = NotificationCenter.default
center.addObserver(forName: Notification.Name("BlockedKeyboardEvent"), object: nil, queue: nil) {
    (note) in NSLog("BlockedKeyboardEvent Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // "true" or "false"
    let blocked = usrInf["blocked"];
    // Package of the keyboard
    let keyboard = usrInf["keyboard"];
    // message specified in the fusion set
    let defaultMessage = usrInf["defaultMessage"];
    // UNIX timestamp of detection
    let timestamp = usrInf["timestamp"];
    // Unique device identifier
    let deviceID = usrInf["deviceID"];
    // Mobile device model
    let deviceModel = usrInf["deviceModel"];
    // Mobile device OS version
    let osVersion = usrInf["osVersion"];
    // Kernel information
    let kernelInfo = usrInf["kernelInfo"];
    // Mobile device manufacturer
    let deviceManufacturer = usrInf["deviceManufacturer"];
    // Build ID
    let fusedAppToken = usrInf["fusedAppToken"];
    // Carrier identity number (PLMN code)
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("BlockedClipboardEvent"), object: nil, queue: nil) {
    (note) in NSLog("BlockedClipboardEvent Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    let blocked = usrInf["blocked"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslCertificateValidationFailed"), object: nil, queue: nil) {
    (note) in NSLog("SslCertificateValidationFailed Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let defaultMessage = usrInf["defaultMessage"];
    let host = usrInf["host"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslServerCertificatePinningFailed"), object: nil, queue: nil) {
    (note) in NSLog("SslServerCertificatePinningFailed Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("UrlWhitelistFailed"), object: nil, queue: nil) {
    (note) in NSLog("UrlWhitelistFailed Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("BlockedScreenCaptureEvent"), object: nil, queue: nil) {
    (note) in NSLog("BlockedScreenCaptureEvent Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // Description of capture method detected
    let context = usrInf["context"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslIncompatibleCipher"), object: nil, queue: nil) {
    (note) in NSLog("SslIncompatibleCipher Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // The Incompatible Cipher Id
    let incompatibleCipherId = usrInf["incompatibleCipherId"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslIncompatibleVersion"), object: nil, queue: nil) {
    (note) in NSLog("SslIncompatibleVersion Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // The Incompatible SSL/TLS version
    let incompatibleSslVersion = usrInf["incompatibleSslVersion"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslInvalidCertificateChain"), object: nil, queue: nil) {
    (note) in NSLog("SslInvalidCertificateChain Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslInvalidMinRSASignature"), object: nil, queue: nil) {
    (note) in NSLog("SslInvalidMinRSASignature Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslInvalidMinECCSignature"), object: nil, queue: nil) {
    (note) in NSLog("SslInvalidMinECCSignature Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslInvalidMinDigest"), object: nil, queue: nil) {
    (note) in NSLog("SslInvalidMinDigest Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The certificate sha1 fingerprint
    let certificateSHA1 = usrInf["certificateSHA1"];
    // The certificate CN (common name)
    let certificateCN = usrInf["certificateCN"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
center.addObserver(forName: Notification.Name("SslNonSslConnection"), object: nil, queue: nil) {
    (note) in NSLog("SslNonSslConnection Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // A detailed message describing the detection
    let threatEventDetailedMessage = usrInf["deveventDetailedErrorMessage"];
    // The host that triggered the detection
    let host = usrInf["host"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}
// Only available when ONEShield Threat Events are enabled
center.addObserver(forName: Notification.Name("AppIntegrityError"), object: nil, queue: nil) {
    (note) in NSLog("AppIntegrityError Threat-event received")
    guard
    let usrInf = note.userInfo
    else {
        return
    }
    // The detected tampered component
    let reason = usrInf["reason"];
    let defaultMessage = usrInf["defaultMessage"];
    let timestamp = usrInf["timestamp"];
    let deviceID = usrInf["deviceID"];
    let deviceModel = usrInf["deviceModel"];
    let osVersion = usrInf["osVersion"];
    let kernelInfo = usrInf["kernelInfo"];
    let deviceManufacturer = usrInf["deviceManufacturer"];
    let fusedAppToken = usrInf["fusedAppToken"];
    let carrierPlmn = usrInf["carrierPlmn"];
    //
    // Respond to mobile app attacks and threats here
    //
}

NotificationCenter.default.addObserver(
    forName: NSNotification.Name("JailbrokenDevice"), 
    object: nil, 
    queue: nil
) { notification in
    guard let userInfo = notification.userInfo else {
        return
    }
    // Respond to mobile app attacks and threats here

    // Notify Appdome to enforce the Threat Event after Threat Event is handled
    NotificationCenter.default.post(
        name: NSNotification.Name("EnforceThreatEvent"), 
        object: nil, 
        userInfo: userInfo
    )
}

Related Articles