From c1eac8789bd72e886761041aea9016a1178bd52f Mon Sep 17 00:00:00 2001
From: Janik Besendorf <janik@besendorf.org>
Date: Mon, 17 Aug 2026 14:31:35 +0200
Subject: [PATCH] Explain AppOps alert timestamp selection

---
 src/mvt/android/artifacts/dumpsys_appops.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/mvt/android/artifacts/dumpsys_appops.py b/src/mvt/android/artifacts/dumpsys_appops.py
index 12a596a..df8539f 100644
--- a/src/mvt/android/artifacts/dumpsys_appops.py
+++ b/src/mvt/android/artifacts/dumpsys_appops.py
@@ -42,6 +42,8 @@ class DumpsysAppopsArtifact(AndroidArtifact):
 
     def check_indicators(self) -> None:
         for result in self.results:
+            # A package IOC match is not tied to one AppOps entry. Use the latest
+            # recorded access or rejection to place the package-level alert in time.
             event_time = max(
                 (
                     entry["timestamp"]