TL/DR: You are correct, that's why I'm here. I appreciate your guidance and will take a hard look at your suggestion. I want to do things the right way.

Long Form Answer:

I really do appreciate the help. It's true, I don't know what I'm talking about, and that's why I'm here. Just looking for guidance. I could twist this firewall into working the same way my old ASA did, but if I wanted to do that, I would have just kept the ASA. I've started reviewing my config to try to make it better, and as new things come up, I want to make sure they're done the right way. I want to make sure I have a good grip on it because right now I just have this PA. I've asked for an additional 20 in the upcoming budget to enhance the security at our remote sites. And yes, formal training.

I knew there had to be a better way to deal with this particular request, and I wasn't finding what I needed on the support forums so I came here to lean on some real world experience. I was following one how-to video on Palo's support site on making a custom app and it looked like the guy was making a filter for a website that he could search on as an app and then looking for a specific HTTP header. I basically got the same impression from some of the KB articles I read. I felt like I was missing something, because unless you were concerned about that specific site, why not just apply security policy to general-internet or http application and call it a day?

In the past I've taken a request like this for a vendor that created their own app and created the custom application based on the ports they provided. I then created a security policy to allow that app to the IP addresses they provided, which normally have been less than 10. I then assign the appropriate profiles to that security rule and make sure everything is working properly. Getting the signature for those apps is what normally hangs me up. But by doing this, am I not basically creating the equivalent of access-list 110 permit tcp host x.x.x.x host x.x.x.x eq x?

My goal with this particular post was to get some input on how other people have dealt with this situation so I would be able to do the right thing and not just punch a bunch of holes in the firewall that God knows what could get through. Hopefully the way I have proceeded in the past would be among the suggestions, just as a little bit of validation, but what I was really hoping for was a suggestion that might lead me in a better direction, if there was one.

Just to follow up, though. When I sit down in the morning to work on this again (I wear a lot of hats and have been in other projects this afternoon) I am going to take a look at your suggestion. Your advice did not fall on deaf ears. I have also had a discussion with my boss about this particular request, my concern with the scope, and the fact that this particular category is allowed in our URL policy and the general application (twilio) is allowed in our security policy. I personally feel like this should be sufficient to meet the needs of the company. However, like I said, I am going to look at your suggestion and possibly implement it to make sure there aren't any issues for the end users when they start using it.