Forwarding logs to Azure Security Center from Panorama does not involve tagging. Tagging can be used on source/destination address, user, or X-Forwarded-For Address, not zones as observed in the GUI.

The log type that will help the engineer verify whether packet buffer protection was activated is Threat Logs. Threat Logs are logs generated by the Palo Alto Networks firewall when it detects a malicious activity on the network. These logs contain information about the source, destination, and type of threat detected. They also contain information about the packet buffer protection that was activated in response to the detected threat. This information can help the engineer verify that packet buffer protection was activated and determine which actions were taken in response to the detected threat.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-log- forwarding

When a failover occurs, the passive device allows transferred sessions without decrypting them.
New sessions will then continue to be decrypted based on your decryption policy.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption- concepts/decryption-and-high-availability

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/virtual-systems/communication- between-virtual-systems/inter-vsys-traffic-that-remains-within-the-firewall/external-zone