To enforce access only for hosts with antivirus or anti-spyware enabled, you need to leverage Host Information Profile (HIP) objects and profiles. First, create a HIP object that specifies criteria such as Anti-Malware enabled with Real-Time Protection. Then, create a HIP profile that matches this HIP object. The GlobalProtect Portal Agent must be configured to collect HIP data, and a Security policy must match the HIP profile for enforcement. Finally, the GlobalProtect Gateway Agent should notify users if their endpoints do not meet the criteria. This ensures that only compliant endpoints are allowed access.

Add the new variable.
A variable name must start with the dollar ( $ ) symbol.
Name the new variable. In this example, the variables are named $DNS-primary and $DNS- secondary
.
Select the variable Type
and enter the corresponding value for the selected variable type.
For this example, select IP Netmask
.
(Optional
) Enter a description for the variable.
Click OK
and Close
https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/manage- templates-and-template-stacks/configure-template-or-template-stack- variables.html#id17B8D0PG0TA

According to the Palo Alto Networks Compatibility Matrix, the three platforms that support PAN- OS 10.2 are:
- PA-800 Series2
- PA-2202
- PA-3400 Series2
The PA-5000 Series and PA-500 do not support PAN-OS 10.2. To upgrade devices to PAN-OS
10.2 using Panorama, you need to determine the upgrade path, upgrade Panorama itself, and then upgrade the firewalls using Panorama.
https://docs.paloaltonetworks.com/compatibility-matrix/supported-os-releases-by-model/palo-alto- networks-next-gen-firewalls

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-reconnaissance-protection