Cortex XDR Agent

Cortex XDR for Android is available for existing Palo Alto Networks Cortex XDR customers with an active Cortex XDR service subscription.
The Cortex XDR app for Android prevents known malware and unknown APK files from running on your Android endpoints, ensuring robust enterprise device security.

How does it work?
The Cortex XDR app enforces your organization's security policy to identify and restrict known malware and unknown files, upload unknown files for in-depth inspection, and treat grayware as malware. You can also whitelist trusted signers to enable unknown apps to run before the Cortex XDR app receives an official verdict.

Use of Accessibility Service:
Cortex XDR uses an Android Accessibility service to protect you from malware applications. It detects when a malicious application is launched and prompts you to stop it. Configuring this is as simple as enabling the Malware Monitoring Service (Settings > Accessibility > Malware Monitoring Service > Enable). Cortex XDR does NOT record or share your app usage statistics.

Use of VPN Service (VpnService):
As an enterprise security agent, Cortex XDR utilizes Android's VpnService under strict system-controlled conditions to ensure continuous protection. The VpnService is used to:
* System-Initiated & Zero-Touch: The VpnService in this app is entirely zero-touch. It does not offer a manual "Start" button and cannot be initiated by the user within the app. Instead, it is designed to be activated automatically by the Android operating system when configured as an "Always-on VPN" by your enterprise administrator or via system settings.
* Monitor, restrict, and block network connectivity for malicious or potentially suspicious applications to prevent data exfiltration.

Data Privacy & Encryption
We are committed to your privacy. All traffic analyzed via the VpnService is strictly used for local device security and threat identification.
* Any data processed through the secure tunnel is encrypted.
* We do not collect, store, or route your personal browsing history, web traffic, or personal data to remote servers for tracking or advertising purposes.