Weaponization and Delivery: Attackers will then determine which methods to use in order to deliver malicious payloads. Some of the methods they might utilize are automated tools, such as exploit kits, spear phishing attacks with malicious links, or attachments and malvertizing. Gain full visibility into all traffic, including SSL, and block high-risk applications. Extend those protections to remote and mobile devices.
Protect against perimeter breaches by blocking malicious or risky websites through URL filtering.
Block known exploits, malware and inbound command-and-control communications using multiple threat prevention disciplines, including IPS, anti-malware, anti-CnC, DNS monitoring and sinkholing, and file and content blocking.
Detect unknown malware and automatically deliver protections globally to thwart new attacks.
Provide ongoing education to users on spear phishing links, unknown emails, risky websites, etc.
https://www.paloaltonetworks.com/cyberpedia/how-to-break-the-cyber-attack-lifecycle

Tags. All Tags. Are specific to the creation of Policy. They have several purposes, apply to any object, can be defined and so forth. I am uncertain as to whether any action subsequent to their application is automated or not. The only thing I'm clear on is, they are Security Policy related, or to it's creation, whether automated or not.

Role Based - Custom roles you can configure for more granular access control over the functional areas of the web interface, CLI, and XML API.

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcns a-study-guide.pdf Applications and Threats: Includes new and updated application and threat signatures, including those that detect spyware and vulnerabilities.