Threat-Events in Android & iOS Apps Explained

Using ‘Threat-Events in Android & iOS apps,’ developers can integrate mobile app threat intelligence with Appdome-built apps to enhance security. This Knowledge Base article reviews in detail how users can leverage Threat-Events to respond or enforce actions after Appdome detects a security event in a mobile app.

About Appdome Mobile App Threat-Events

Appdome Threat-Events use industry-standard notification methods to pass events from the Appdome layer back to the application so that the application can take further action whenever Appdome detects malicious events against an Appdome-protected app.

When Appdome detects a security event, the event can be handled in one of the following ways:

In-App Detection

Appdome detects the attack or threat and passes the event in a standard format to the app for processing (your app chooses how and when to enforce).

In-App Defense

When Appdome detects a security violation performed on the app, it will pass the event from the Appdome layer to the app. Appdome’s security engine will handle the event. The default behavior is for the app to exit after displaying a compromise notification to the end user (compromise notifications are customizable).

Enforce Connection Only (for Secure Communication/MitM Attack Prevention and Secure Certificate Pinning only):

When Appdome detects a security event, it passes the event from the Appdome layer to the app and blocks the connection that triggered the event.

By design, when the mobile application registers to receive Appdome Threat Events, Appdome will send an initial event. If Appdome detects a security event during the app launch/run, the initial event will hold the triggered security event details. If no security event is triggered, the initial event will only indicate a successful registration to Appdome Threat-Events (the event fields will hold no data).

Threat-Event Failsafe Enforcement

When the Failsafe Enforcement toggle is enabled, the selected In-App Detection Threat Event undergoes a hardening process. Appdome not only sends threat data to the app but also implements delayed enforcement against the identified threat. This mode grants the protected app the ability to manage the user experience (UX) when informing the end user about the threat while delegating the actual enforcement to Appdome.

For more details, please see How to Implement Failsafe Enforcement with In-App Detection.

About Appdome Threat-Event Score

Appdome Threat-Event Score is used for advanced threat handling and response. With Threat-Event Score, you can configure each Threat-Event with a unique score in order to value the importance of a particular threat or prioritize how threats are handled after Appdome detects a threat.

Risk scoring allows users to evaluate threats based on multiple selected Threats at a given time. By assigning a risk weight to each Threat Event, you can prioritize its importance in the total risk assessment.

Appdome divides Threats into two groups: consistent and volatile. Consistent events affect the total score for the entire session of the app, while volatile events only affect the total score for a short period. Consistent events include root detection and tampering with the app. All other events are considered volatile.

When activating the Threat-Event Score toggle on Appdome, you can set a numerical value (between 1-1000) that you can set for each applicable Threat-Event for any Android or iOS app. This additional scoring attribute is passed as part of an Appdome Threat Event. Threat-Event Score attributes are persistent (i.e., fixed) in each mobile app build. To update a Threat Score to reflect a new risk profile for the app or a given threat, you can re-build the app with a new Threat-Event Score on Appdome.

The Threat-Event Score can be set or adjusted according to a user-defined risk model. Threat-Event Scores can be assigned to multiple threats, allowing you to set a threshold for when a security action or workflow will be taken. With Threat-Event Score, developers are enabled to customize the enforcement model and tailor the user experience according to the relative or absolute importance, criticality, or severity level of each threat.

How to Add Threat-Event Score to an Android or iOS App

With Threat-Event turned ON for any applicable feature, turn ON Threat-Event Score and set the Threat-Score to the requested value (1-1000) for each attack or threat.