For example, the standard methods cannot add mappings of users connecting from a third-party VPN solution or users connecting to a 802.1x-enabled wireless network. For such cases, you can use the PAN-OS XML API to capture login events and send them to the PAN-OS integrated User- ID agent.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/user-id-concepts/user- mapping/xml-api

You define the file name based on the stage (Drop, Firewall, Receive, or Transmit).
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/monitor/monitor- packet-capture/packet-capture-overview

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/globalprotect/network- globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent- app-tab

The log type that will help the engineer verify whether packet buffer protection was activated is Threat Logs. Threat Logs are logs generated by the Palo Alto Networks firewall when it detects a malicious activity on the network. These logs contain information about the source, destination, and type of threat detected. They also contain information about the packet buffer protection that was activated in response to the detected threat. This information can help the engineer verify that packet buffer protection was activated and determine which actions were taken in response to the detected threat.