By default, the firewall implicitly allows intrazone traffic (within a zone) and implicitly denies interzone traffic (between zones).
By default, traffic allowed or denied by the implicit Security policy rules is not logged on the firewall.

To enable credential phishing prevention, you must configure both User-ID to detect when users submit valid corporate credentials to a site (as opposed to personal credentials) and URL Filtering to specify the URL categories in which you want to prevent users from entering their corporate credentials.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/prevent-credential- phishing

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/manage- firewall-administrators/configure-administrative-accounts-and-authentication/configure-a-firewall- administrator-account