Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

Explanation
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall-administrat

Explanation
Decryption Broker is a feature that allows you to use a Palo Alto Networks firewall as a decryption broker for other security devices in your network . It works by decrypting traffic on one interface and forwarding it to another interface where it can be inspected by other devices before being re-encrypted and sent to its destination2. The firewall acts as a transparent bridge between the two interfaces and does not change the source or destination IP addresses of the traffic To configure Decryption Broker, you need to assign decryption forwarding interfaces (DFIs) to the virtual router that routes the traffic that you want to inspect. The DFIs are used to forward decrypted traffic from one interface to another in a security chain . A security chain is a set of devices that perform different security functions on the same traffic flow . You can have multiple security chains for different types of traffic or different segments of your network3.
The reason why you need to assign DFIs to the virtual router that routes the traffic is because Decryption Broker uses routing tables to determine which DFI belongs to which security chain and how to forward traffic between them2. If you assign DFIs to a different virtual router than the one that routes the traffic, Decryption Broker will not be able to find them or forward traffic correctly2.

Explanation
When overriding the firewall configuration pushed from Panorama, the modification will not be visible in Panorama. The firewall will show an override icon next to the modified setting and will display a warningmessage that the local configuration differs from Panorama. The override icon will also appear on Panorama next to the firewall name in the Device Groups and Templates tabs1. The other options are not correct. The firewall template will not show that it is out of sync within Panorama, because the template itself is not modified. Panorama will not update the template with the overridden value, because the template is read-only on the firewall. The override can be reverted either from Panorama or from the firewall2.
References: 1:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-configuration/over
2:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage-configuration/reve

Explanation
"Threat/Content Type (subtype) Subtype of threat log." "packet-Packet-based attack protection triggered by a Zone Protection profile."https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/sysl
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field packet-Packet-based attack protection triggered by a Zone Protection profile.