Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Application Permission · source-mapped
DC0114 collection page — Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.
Providers and collection configuration
- Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
- Android dumpsys: Point-in-time service/package state on an authorized development device.
- Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.
- Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
- Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
- Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.
Required normalized fields: package, permission, declared, granted.
adb shell dumpsys package test.example.lab
Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0114",
"collector": "illustrative-lab-collector",
"observation": {
"package": "test.example.lab",
"permission": "android.permission.CAMERA",
"declared": true,
"granted": false
}
}
Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.
Application State · source-mapped
DC0123 collection page — Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.
Providers and collection configuration
- Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
- Android dumpsys: Point-in-time service/package state on an authorized development device.
- Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.
- Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
- Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
- Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.
Required normalized fields: package, state_before, state_after, source.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0123",
"collector": "illustrative-lab-collector",
"observation": {
"package": "test.example.lab",
"state_before": "background",
"state_after": "foreground",
"source": "own_app_callback"
}
}
Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.
File Creation · source-mapped
DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_id, path, action, size_bytes.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0039",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"path": "C:\\Lab\\demo.txt",
"action": "create",
"size_bytes": 64
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Network Traffic Content · source-mapped
DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: flow_id, protocol, method, path, payload_excerpt.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0085",
"collector": "illustrative-lab-collector",
"observation": {
"flow_id": "lab-flow-1",
"protocol": "http",
"method": "GET",
"path": "/lab-check",
"payload_excerpt": "LAB_TELEMETRY_CHECK"
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
OS API Execution · source-mapped
DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.
Providers and collection configuration
- Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
- Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
- Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.
Required normalized fields: process_id, api, path, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0021",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"api": "CreateFileW",
"path": "C:\\Lab\\demo.txt",
"result": "success"
}
}
Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.