When defining policies in Panorama, the three rule types available are:
Pre Rules - These are evaluated first and are applied at the top of the rule hierarchy. They are typically used for organizational policies that need to be enforced universally, such as blocking specific categories of traffic or allowing necessary traffic like DNS.
Post Rules - These are evaluated after the pre-rules and any locally defined rules on the firewall.
They are often used for default deny rules or logging all denied traffic.
Clean Up Rules - These rules ensure that any traffic not matched by earlier rules is handled appropriately, often used to log or block traffic that didn't meet any other rule criteria.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljVCAS

User-ID log is management plane log, so its forwarding profile should be set up at "Device\Log settings".

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to- users/configure-user-mapping-using-the-pan-os-integrated-user-id-agent