To safely enable applications you must classify all traffic, across all ports, all the time. With App- ID, the only applications that are typically classified as unknown traffic--tcp, udp or non-syn-tcp--in the ACC and the Traffic logs are commercially available applications that have not yet been added to App-ID, internal or custom applications on your network, or potential threats.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/manage-custom-or- unknown-applications

If you know the source or destination IP address, the test command from the CLI will search the security policies and display the best match:
Example:
> test security-policy-match source <source IP> destination <destination IP> protocol <protocol number> The output will show which policy rule will be applied to this traffic match based on the source and destination IP addresses.
https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-Which-Security-Policy- Applies-to-a-Traffic-Flow/ta-p/53693

Configure security chain devices with Layer 3 interfaces to connect to the security chain network.
These Layer 3 interfaces must have an assigned IP address and subnet mask.
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption- broker/security-chain-layer-3-guidelines.html