We have been doing this recently after some security incidents. Constant monitoring of all security related events, and being able spot anomalys which our normal system isn’t able to catch. The active part is just emailing us right now, but I am considering adding some light lock down actions.

Interesting, might be fun to try my hand at it sometime. Is the best way to actually get the APKs to just download them from an apk mirror site.

You should be able to get free APKs straight from Google via Aurora Store.

Yes! APKMirror is a good choice. AndroZoo works too, but it's academic and you need to apply for API access.

APKPure is pretty good too, they don't have captchas for downloads so you can make a simple script to pull the APK from them based on the package name.