You can monitor PAN VPN / IPSec Tunnels by an Interface. PA Creates for all IPSec a own Tunnel Interface. And when connection is down, the interface is down too.
So make it like @mike1098 told. Service check command check_mk-if64
There are some nice other PAN Checks. Have a view on
integrations/globalprotect_utilization
integrations/palo_alto_users