https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service- routes-overview

Delivery: This stage marks the transition from the attacker working outside of an organization's network to working within an organization's network. Malware delivered during this stage is designed to exploit existing software vulnerabilities. To deliver its initial malware, the attacker might choose to embed malicious code within seemingly innocuous PDF or Word files, or within an email message.
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcns a-study-guide-latest.pdf

Devices now support Terminal Access Controller Access-Control System Plus ( TACACS+) protocol for authenticating administrative users. TACACS+ provides greater security than RADIUS insofar as it encrypts usernames and passwords (instead of just passwords), and is also more reliable (it uses TCP instead of UDP).

Decryption port mirroring allows you to copy decrypted traffic from a firewall and then send it to a traffic collection tool, such as NetWitness or Solera. Decryption mirroring requires a Decryption Port Mirror license. This license is free of change and you can activate it through the customer support portal.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-decryption- port-mirroring

Phishing attack prevention extends the URL filtering capabilities to actively detect targeted credential phishing attacks through a cloud-based analytics service as well as through heuristics on the device itself.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/prevent-credential- phishing/set-up-credential-phishing-prevention