Galaxy's OLAP query gateway exposes a `session_record` table whose per-session schema places direct mobile-subscriber-identity columns (subscriber_id, imei, imsi, phone_number, apn) alongside full network/application metadata (client and server IP/ASN/geolocation, app, domain, HTTP/DNS/TLS fields), confirmed by a raw SQL SELECT statement embedded in a galaxy-troubleshooting-api Postman request that enumerates roughly 200 columns of a single production session record by name.
client_ip, client_port, client_os_desc, client_geolocation, client_asn, subscriber_id, imei, imsi, phone_number, apn, server_ip, server_port, server_os_desc, server_geolocation, server_asn, server_fqdn, server_domain
Defense implications
- Treat GTP/mobile-core sessions as individually identifiable end-to-end (down to phone number) at the same query layer analysts use for routine troubleshooting -- not just in a separate lawful-intercept subsystem.
- Any circumvention traffic pattern that is stable across a subscriber's sessions (fixed egress IP, recognizable app signature) is correlatable to that subscriber's IMSI/phone number without additional carrier lookups.
Cited artifacts
mesalab_git—galaxy/platform/galaxy-troubleshooting-api.bundle:24.08/config/tsg-olap-function-test-collection.json(config)
Provenance pointers only — no leak content is rehosted. Raw material: Enlace Hacktivista.
Related findings
Release 24.04 (28 APR 2024) adds province/city-granularity ("administrative area") geo-tagging to every session and security-event log for both client and server -- client_country/client_super_administrative_area/ client_administrative_area/client_sub_administrative_area and the server-side equivalents -- plus Client ASN/Server ASN as dedicated Statistics Rule Metric datasets, confirming sub-national geolocation is a standard enrichment field across TSG's logging pipeline, not a specialized lookup.
The app_recommend Flink job (Recommendation.java, job name "RECOMMENDATION-APP-CIP") keys incoming traffic by (app_label, client_ip), computes a sliding-window top-N of active client IPs per identified application via TopnHotItem's priority queue, and HbaseSink persists the result as an app-to-client-IP-list association -- row key MD5(app_label), columns app_label/client_ip_list/last_update_time -- in HBase. This is the source of the "Recommend App Active Client IP" troubleshooting lookup referenced in galaxy-troubleshooting-api's Release 21.12 changelog.
galaxy-troubleshooting-api's Postman collection defines a full "DoS Threat Map" dashboard API suite (folder-scoped request names: dos-threat-map-top- source-countries, dos-threat-map-top-destination-countries, dos-threat-map- top-victims, dos-threat-map-attack-type, dos-threat-map-severity, dos-threat- map-destination-ip-distribution, dos-threat-map-attack-connection, dos-threat-map-attack-volume-summary, dos-threat-map-attack-volume-trend), plus a separate DNS-amplification "Resolver" detection dataset and a per-victim-IP historical traffic-trend query -- confirming Galaxy exposes operator-facing DDoS-detection/geolocation dashboards built on top of TSG telemetry, distinct from its censorship/content-blocking function.
The `session_record` schema includes explicit boolean-style flag columns ssl_esni_flag and ssl_ech_flag, confirming that TSG/Galaxy tags every session with whether Encrypted SNI or Encrypted ClientHello was used -- giving the operator session-level visibility into ECH/ESNI adoption even where it cannot decrypt the underlying SNI.
galaxy-troubleshooting-api's Release 22.08 (31 AUG 2022) changelog adds four dedicated "recommend" endpoints that resolve IMSI, IMEI, phone number, and APN to GTP tunnel-endpoint ID (TEID) -- i.e. mobile-core identity-to-tunnel correlation exposed as a first-class, individually testable API surface at Galaxy's OLAP layer, corroborating the tsg_olap subtree's relationship-gtpc-user component. A "Top Subscribers" report existed on the same platform until it was explicitly removed in Release 24.04 (28 APR 2024).
The same `session_record` schema includes a literal `mail_password` column alongside mail_account/mail_from/mail_to/mail_cc/mail_bcc/mail_subject/ mail_attachment_name and a full per-session `mail_eml_file` capture, plus `ftp_account` and `ftp_url` -- confirming Galaxy's OLAP layer stores cleartext mail and FTP credentials and full message content per session, not just connection metadata.