---
title: "Threat Detection"
description: "Break a month's detections down by threat type, device, OS version, and country."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

**Threat Detection** is where you go once the [Dashboard](https://docs.doverunner.com/mobile-app-security/console/dashboard/dashboard-guide/) has told you something is off and you want to know what kind of attack it is and which devices are behind it. The console describes it as *Hacking analytics and devices information*.

Open **Mobile App Security → Analytics → Threat Detection**.

## Filters

Same as the Dashboard: **Sealing Mode**, **Operating System**, **Application**, and **Period**.

## Widgets

### Threats Detected

The period's total, with a toggle that switches every figure below between **HACKING ATTEMPTS** and **UNIQUE DEVICES HACKING ATTEMPTS**, then a breakdown across the threat categories. The categories depend on the selected operating system.

**Android**

| Category | Detected when |
| :------- | :------------ |
| **Code Hooking** | A hooking framework manipulates the app at runtime. |
| **Security Config Manipulation** | Security settings have been tampered with or disabled. |
| **Source Code Modification** | App code or binary has been modified. |
| **Application Repackaging** | The app has been repackaged or resigned. |
| **Application Debugging** | A debugger is attached to the app. |
| **Rooted Device** | The device is rooted. |
| **App Cloning Environment** | The app runs in a virtual space, dual-app, or cloned environment. |
| **Malware & Cheat Tool** | A cheat tool or known malicious package is present. |
| **Emulator** | The app runs in an emulator. |
| **USB Debugging** | ADB/USB debugging is enabled. |
| **Speed Modification** | A speedhack is altering system time or speed. |
| **Other** | Detections not covered above. |

**iOS**

| Category | Detected when |
| :------- | :------------ |
| **Jailbreak** | The device is jailbroken. |
| **Dynamic memory cracking** | The app's memory is manipulated at runtime. |
| **Application Repackaging** | The app has been repackaged or resigned. |
| **Application Debugging** | A debugger is attached to the app. |
| **Security Config Manipulation** | The security module has been bypassed. |
| **Malware & Cheat Tool** | A cheat tool is present. |
| **Speed Modification** | A speedhack is altering system time or speed. |

**Note:** 
Switching to **UNIQUE DEVICES HACKING ATTEMPTS** is the quickest way to tell a broad campaign from a single noisy device. Code Hooking and Malware & Cheat Tool routinely dominate the attempt count while affecting far fewer devices.


### Threats Types

A donut chart of the same breakdown, showing each category's share of the period's detections.

### Hacking Attempts By Device Information

Device-level detail for the riskiest detections. For Android apps, the console notes that this table **excludes cheat tool and app cloning environment entries**, because they occur more often than their severity warrants — so the list stays focused on devices worth investigating.

**FILTER** narrows the list, **EXPORT** downloads it, and **Fetch limit** controls how many records are retrieved: `100` (default), `1,000`, `5,000`, or `10,000`.

The columns depend on the selected operating system:

| Column | Group | Platform | Meaning |
| :----- | :---- | :------- | :------ |
| **Action** | — | Both | Icons that open more detail for the row. See below. |
| **Reported On** | — | Both | When the detection was reported. |
| **Android Id** | Device Details | Android | The device's SSAID. |
| **UUID** | Device Details | iOS | The device UUID. |
| **Model Name** | Device Details | Both | Device model. |
| **Android Version** / **iOS Version** | Device Details | Both | OS version. |
| **Country** | Hacking Details | Both | Where the detection came from. |
| **Attempts** | Hacking Details | Both | Number of attempts recorded. |
| **Rooting** | Hacking Details | Android | Whether the device is rooted (**Rooted** or **Not Rooted**). |
| **Hacking Type** | Hacking Details | Both | The threat category. |

**Caution:** 
`Android Id` is the SSAID. Review the behaviour of users matching an SSAID before acting on it — and treat the value as personal data.


The **Action** column holds this icon:

- **Magnifier** (Android only) — opens the device details view described below.

**Note:** 
The device details view is available only with the Professional or Enterprise plan. To use it, contact the [Help Center](https://support.doverunner.com).


#### Device details

Clicking the magnifier replaces the page with a drill-down for that device. Use the back arrow at the top to return.

| Section | Contents |
| :------ | :------- |
| **Device Information** | Android Id, Device Model, Operating System, Rooting Enabled, Country, and Package Name. |
| **Protection History (Last 2 Weeks)** | A line chart and a table of the device's protection records over the last two weeks, up to 1,000 records. Table columns: Reported On, App Version Code, App Version Name, AppSealing Version, Attempts, Hacking Type, and Details. |
| **Protected Hacking Attempts** | A daily bar chart for the currently selected month, with a table of Reported On, Hacking Type, Hacking Details, and Protected Hacking Attempts. |

### Hacking Type

A daily stacked chart across the period with one series per category, so you can see when a particular attack type started or stopped.

### OS Version and Rooting

Three percentage cards summarising how the period's detections distribute across **OS Version - Major**, **OS Version - Minor**, and **Rooting**. For iOS apps, the **Rooting** card is replaced by **Jailbreak**.

### Hacking Attempts By Map Overlay

A world map of the period's detections, paired with **Hacking Attempts By Country List**:

| Column | Meaning |
| :----- | :------ |
| **Country** | Country the detections came from. |
| **Hacking Attempts** | Detections from that country. |
| **Unique Devices Hacking Attempts** | Distinct devices behind them. |