A best practice for installing the Windows User-ID agent is to deploy it in close proximity to the servers it will be monitoring. The User-ID agent monitors Active Directory events, such as logins and logoffs, and maps them to IP addresses for User-ID mapping. Installing the agent on a system close to the servers (e.g., domain controllers) ensures it can efficiently and quickly process authentication events without delays that may occur over long distances or in high- latency environments.

Using Policy Optimizer to migrate to application-based rules, adding the container application (Option D) ensures future-proofing. Container apps (e.g., "web-browsing") include child apps (e.g., specific web services) as signatures evolve, maintaining rule accuracy without over- matching unrelated traffic.

When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release. In addition, the recommended upgrade path includes installing the latest maintenance release in each release version before you install the base image for the next feature release version.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the- firewall-pan-os/determine-the-upgrade-path

Credential phishing prevention works by scanning username and password submissions to websites and comparing those submissions against valid corporate credentials.