Otukan shows your security team how your mobile app is attacked after release, on real devices. Protected apps send runtime threat signals to your backend while they run. Otukan groups them by release, platform, device and account and separates a detection (a check fired) from a confirmed attack (signals and backend evidence agree) and a business incident (users, money or data affected). Analysts see which signals matter, and the findings drive your app response policy and the SOC tools you already run. It covers Android, iOS, Flutter and React Native apps, reporting each platform on its own terms.
Event meaning
The same signal can mean very different things. Otukan labels each level, so a single detection does not set off an incident response.
| Level | What it is | Example | Who acts |
|---|---|---|---|
| Detection | One check fired on one device | A hooking framework seen in the app’s process at login | App response policy acts automatically; analysts watch trends |
| Confirmed attack | Signals and backend evidence agree | The same detection across many new accounts, with scripted API patterns | Security team investigates and tightens policy |
| Business incident | An attack with real impact | Fraudulent transfers from accounts that showed those signals | Incident response, fraud and business owners |
Every check maps to a small set of severity levels, so an analyst can tell a low-risk developer-device signal from repeated tampering on a payment flow without reading the app’s code. What a single signal records is covered on runtime threat signals.
Investigation
Aggregation
One device tells you little; patterns tell you a lot. Otukan counts signals over time, by check, platform and OS version, and highlights change. A sudden rise in one check on one Android version points to a new system image; a rise across versions tied to new accounts points to a campaign. Trend views are covered on threat analytics.
Filters
Analysts narrow signals quickly: by check, severity, app version, platform, OS version and time window, and by pseudonymous account or install identifier when a case needs it.
Linkage to app releases
Every signal carries the app build that produced it. Otukan compares rates before and after each release, so you can tell whether attackers shifted or a check changed, and see whether older versions still in use are being targeted. That makes monitoring a direct input to release planning. Case handling is covered on threat investigation workflows.
Platform differences
Android and iOS signals are reported separately. Android checks can usually see more of the system and report more categories; iOS checks work inside a tighter sandbox and infer more indirectly. Otukan keeps comparisons within a platform, so a gap between platforms reads as a difference in visibility, not in attack volume.
Action
App policy
Monitoring shows which responses are safe to enforce. Start a new check in observe mode, see how often it fires on legitimate users, then move specific flows to warn, restrict or terminate. When rates change, Otukan shows it, and you adjust the policy with evidence. Policy design is covered on threat response.
Existing SOC tools
Mobile signals are most useful next to login, API and fraud logs. Otukan delivers normalised signals to the SIEM or SOC platform you already run, with a field format and severity scale agreed with your SOC. Send high-severity signals and summaries rather than everything, and name who owns a mobile alert at each level. SIEM delivery is covered on SIEM integration.
Privacy of telemetry
Threat monitoring must never become user monitoring, and Otukan is designed that way. Signals carry what a decision needs and nothing more:
- which check fired, its result and a timestamp;
- app build, platform and OS version;
- a pseudonymous install or device identifier, never a name, phone number or email;
- no message content, contacts, precise location or file contents.
Retention is set before collection starts, access to account linkage can be restricted, and data flows are documented for your privacy team. Data handling is covered on data privacy.
For the wider picture, return to mobile app security.