The 'running' configuration is currently active on the Palo Alto Networks firewall.
The 'candidate' configuration is reflected on the web UI and is updated each time a change is made prior to a commit. However, the 'candidate' configuration changes are lost if a system reboot or management server restart occurs.
Clicking on 'save' (see screenshot below) causes the system to save the candidate configuration to a hidden file, enabling the un-committed changes to survive a reboot or management server restart.