Operate
Operations covers keeping the estate healthy and the configuration controlled: monitoring, commits, updates, and reporting. The dashboard, ACC, and traffic/threat/URL logs are the primary visibility surfaces; log filters and the traffic log detail view answer most "what happened" questions. Know the difference between a commit (push local candidate config to the running config) and a commit and push from Panorama, and know that partial commits apply only changed items while a full commit applies everything - useful when a validation warning blocks a full commit.
Update management is a regular operational task: software releases with preferred/supported status, content updates (Applications and Threats, Antivirus, WildFire, URL filtering, DNS security, GlobalProtect data), and license/subscription expiry monitoring. Automation via scheduled config exports, email/SNMP/syslog alerting, and log forwarding to Panorama, Cortex Data Lake, or an external SIEM keeps the operational loop closed. Log storage deserves attention: disk quotas per log type and forwarding decisions determine how far back you can investigate, and log forwarding failures are silent unless monitored.
Traps: assuming a saved candidate configuration is active (it is not until committed); assuming Panorama's commit pushes to firewalls; ignoring that a passive/active HA pair's secondary shows stale dashboards; and forgetting that content version mismatches between Panorama and managed devices raise commit warnings.
Rule of thumb: before every change window, export the running configuration, confirm HA peers are synchronized, and verify content and software versions match across the pair - then commit, verify with the traffic log, and back up again.