https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/view-and-manage- reports/generate-custom-reports

Palo Alto Networks NGFW provides several mechanisms for user mapping, which helps in identifying and applying policies based on user identity rather than just IP addresses.
* Captive Portal: This method redirects users to a portal where they must authenticate before accessing the network. It captures user credentials and maps them to their IP addresses.
* Domain server monitoring: This involves monitoring Active Directory (AD) domain controllers to map users to their respective IP addresses based on login events.
* Client probing: This mechanism involves directly querying devices on the network to determine the logged-in user. It's useful for mapping IP addresses to usernames dynamically.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

The key benefit of Palo Alto Networks' Single Pass Parallel Processing (SP3) design is that it allows the addition of new functions to existing hardware without significant performance degradation. The SP3 architecture processes traffic in a single pass, applying all security functions (such as threat prevention, URL filtering, and application identification) simultaneously, which enhances performance and efficiency. This design ensures that the firewall can scale to meet increasing demands and integrate new security features as they are developed.
References: Palo Alto Networks SP3 architecture whitepaper.