Stage 1 Load Data Drop your files to begin
Revocation List
Cross-origin fetch is blocked, so this is a manual hop:
- Open android.googleapis.com/attestation/status
- Save as
.json - Drop it below
Drop status.json
or click to browse
Merged Attestation + Integrity Dump
One splunk query, both fields per row:
splunk query
index=identity_kubernetes_prod app=key-registry "event.request.path"="/attestation" "event.request.headers.user-agent"="*Titan*Mobile*" | spath input=_raw path="event.domain" output=domain | table _time, domain
Drop dump.json
or click to browse — NDJSON expected, multiple files ok
Stage 2 Sanitize Load data first
Entries missing the attestation object entirely (integrity-only or fully unparsable) are always excluded — attestation is the mandatory first gate.
Stage 3 Attestation Rules Load data first
Revoked always fails, across the whole chain (leaf, intermediates, root) — not configurable, it's a data fact, not a policy.
ms
Attestation Key Security Level
Attestation Key / Keymaster Combos
Stage 4 Integrity Rules Load data first
App Licensing Verdict
App Recognition Verdict
Version Code
Known version codes
Device Recognition
Min SDK Version
Device Activity Level
App Risk Signals
Check a box to FAIL any entry where that app type is found on the device.