https://docs.paloaltonetworks.com/dns-security/administration/configure-dns-security/enable-dns- security#tabs-id066476b2-c4dd-4fc0-b7e4-f4ba32e19f60

An application group is an object that contains applications that you want to treat similarly in policy. Application groups are useful for enabling access to applications that you explicitly sanction for use within your organization. Grouping sanctioned applications simplifies administration of your rulebases. Instead of having to update individual policy rules when there is a change in the applications you support, you can update only the affected application groups.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/use-application-objects-in- policy/create-an-application-group