pantag to update dynamic group

Hi community, I wish to know if the following 1. For pantag to update the dynamic group, i am assuming that the data from wildfire is sufficient to accomplish this. The reason is that we have a splunk cloud and our panorama are located on prem. The only way to perform the integration is to deploy a on prem splunk enterprise that will use the data from wildfire which is collected via api. 2. If the malware connects to microsoft site to download powershell, does it get block as well after running the script? Rgrds, Benson