To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

What is the recommended way to ensure that firewalls have the most current set of signatures for up-to-date protection?

A customer requests that a known spyware threat signature be triggered based on a rate of occurrence, for example, 10 hits in 5 seconds.
How is this goal accomplished?

A customer is targeted by a true zero-day, targeted attack. However, the customer is protected by the Palo Alto Networks security platform.
The attack leverages a previously unknown vulnerability in IE but utilizes existing hacking techniques on the endpoint. It is transported over standard HTTP traffic and conforms to the HTML standards. It then attempts to download from a website, compromised specifically for this attack, a custom piece of malware to run on the endpoints.
Which element of the platform will stop this attack?

Which Palo Alto Networks security platform component should an administrator use to extend policies to remote users are not connecting to the internet from behind a firewall?