What do the Security Intelligence Events within the FMC allow an administrator to do?

Security Intelligence (SI) in Cisco Firepower Management Center (FMC) leverages dynamically updated feeds of known-bad indicators (IP addresses, URLs, domains) to identify and block connections from internal hosts to external malicious destinations, thus allowing an administrator to see if a host is connecting to a known-bad domain. These events provide crucial context for early threat detection and incident response by identifying communication with command-and-control servers or other threat infrastructure.

While FMC can monitor all traffic, "host-to-server traffic within your network" is a general description of network activity, not the specific value provided by Security Intelligence events, which focus on malicious connections.

Viewing malicious files downloaded by a host is primarily the function of Advanced Malware Protection (AMP) or intrusion prevention systems (IPS) capabilities within Firepower, not directly "Security Intelligence Events" which are focused on reputation-based blocking of network connections.

"Host-to-host traffic within your network" is a general network monitoring capability; Security Intelligence specifically highlights connections to known malicious external entities, not just any internal host-to-host traffic.