In addition to forwarding unknown and blocked samples
for analysis, the firewall also forwards information about the network
session for a sample. Palo Alto Networks uses session information
to learn more about the context of the suspicious network event,
indicators of compromise related to the malware, affected hosts
and clients, and applications used to deliver the malware.
