In addition to forwarding unknown and blocked samples for analysis,
the firewall also forwards information about the network session
for a sample. Palo Alto Networks uses session information to learn
more about the context of the suspicious network event, indicators
of compromise related to the malware, affected hosts and clients,
and applications used to deliver the malware.