The primary purpose of creating a custom application in Palo Alto Networks firewalls is to enhance visibility and control over traffic that is not recognized by the standard App-ID database. This is crucial for two main reasons:

1. Identifying Proprietary/Internal Applications: Organizations often use custom-developed applications for internal operations. Creating a custom application signature allows the firewall to correctly identify, log, and apply specific security policies to this traffic, which would otherwise be unclassified.

2. Reducing Unidentified Traffic: When App-ID cannot identify an application, the traffic is often logged as "unknown-tcp" or "unknown-udp." By creating a custom application for this traffic, administrators can properly classify it, thereby reducing the amount of unidentified traffic on the network and improving the overall security posture and reporting accuracy.

B. To change the default categorization of an application: This is the function of an Application Override policy, which re-classifies traffic already identified by App-ID, not the creation of a new custom application signature.

C. To visually group similar applications: This is accomplished by creating Application Groups or Application Filters, which are used to bundle multiple applications (standard or custom) for easier policy management.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Create a Custom Application" section:

"If you have a custom application running on your network for which an App-ID does not exist

you can create a custom application signature... Creating a custom application enables you to... more accurately control the application and reduce the security risk associated with unknown TCP/UDP traffic." This statement directly supports options A and D.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Application Override" section:

"Application override policies allow you to override the normal identification of traffic... For example

you can create a policy to classify your custom accounting application that runs on TCP port 3400 as 'my-accounting-app' instead of as 'unknown-tcp'." This clarifies that Application Override is for re-classifying traffic

distinguishing it from the initial identification purpose of a custom application

thus invalidating option B.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Objects > Application Groups" section:

"Application groups are a way to group applications so that they can be used in policies." This confirms that grouping applications is the specific function of Application Groups

making option C incorrect.