There seems to be a discrepancy in license expiration detection on Palo Alto devices using the PA-440 API based query template.

 

Symptom:

1. Tigger for "DNS Security" license expiration fires

Expected:

1. If there is also a valid license for "Advanced DNS Security", the DNS Security expired trigger should either not be created or not fire.
2. The same would apply for:
   1. Threat Prevention vs Advanced Threat Protection
   2. PAN-DB Url Filtering vs Advanced URL Filtering
   3. Wildfire License vs Advanced Wildfire License

Example screenshot below: