While you can configure
either the Windows agent or the PAN-OS integrated User-ID agent
on to listen for authentication syslog messages from the network
services, because only the PAN-OS integrated agent supports syslog
listening over TLS, it is the preferred configuration.