Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.
https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use- case-respond-to-an-incident-using-panorama/review-wildfire-logs

Note: The administrator of the satellite must enter the credentials when the satellite connects to the portal.
This is done on the satellite by navigating to Network > IPSec Tunnels and choosing "gateway info" and then clicking on "Enter Credentials".

The Group Include List in the Group Mapping settings of a Palo Alto Networks firewall allows the administrator to specify the exact Active Directory groups that need to be imported and used in policies. Although the active directory may contain 1500 groups, the engineer only needs 800 groups. By creating a single Group Include List with the required 800 groups, the firewall will retrieve and map only those groups, ensuring efficient operation without exceeding the limits or unnecessarily importing unused groups.

The error "Received fatal alert UnknownCA from Client" indicates that the client did not recognize or trust the CA certificate presented by the firewall during the decryption process. This typically happens when the client is configured to expect a certificate signed by a different CA or the provided CA certificate does not align with the client's trust settings. The firewall's presented certificate likely does not match the client's expected CA, which caused the connection to fail.