Creating the GlobalProtect portal is as simple as letting it know if you have accessed it already. A new gateway for accessing the GlobalProtect portal will appear. Client authentication can be used with an existing one.
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless- vpn/clientless-vpn-overview

On the Device Dynamic Updates page, select Schedule . Choose to Disable new apps in content update for downloads and installations of content releases.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/manage-new-app-ids- introduced-in-content-releases/disable-or-enable-app-ids

This feature enables the configuration of log forwarding to external destinations, including SIEM systems, via syslog server profiles. By setting up these profiles and assigning them to the appropriate log types, Panorama can efficiently forward logs to an external SIEM for further analysis and monitoring.
https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-log- collection/configure-log-forwarding-from-panorama-to-external-destinations

When defining policies in Panorama, the three rule types available are:
Pre Rules - These are evaluated first and are applied at the top of the rule hierarchy. They are typically used for organizational policies that need to be enforced universally, such as blocking specific categories of traffic or allowing necessary traffic like DNS.
Post Rules - These are evaluated after the pre-rules and any locally defined rules on the firewall.
They are often used for default deny rules or logging all denied traffic.
Clean Up Rules - These rules ensure that any traffic not matched by earlier rules is handled appropriately, often used to log or block traffic that didn't meet any other rule criteria.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljVCAS