While you can configure
either the Windows agent or the PAN-OS integrated User-ID agent
on to listen for authentication syslog messages from the network services,
because only the PAN-OS integrated agent supports syslog listening
over TLS, it is the preferred configuration.