What do the Security Intelligence Events within the FMC allow an administrator to do?

Security Intelligence in FMC uses threat intelligence feeds (such as Cisco Talos) to identify and log traffic to known-bad IP addresses, URLs, and domains. When a host attempts a connection to a blacklisted domain, the Security Intelligence Event is generated, giving administrators direct visibility into that activity. This is the core purpose of the Security Intelligence feature - correlating network traffic against threat reputation data.

Host-to-server traffic monitoring within the network is a function of network traffic analysis or connection events, not Security Intelligence Events specifically.

Viewing malicious files downloaded by a host is the function of the Malware/AMP (Advanced Malware Protection) events in FMC, not Security Intelligence Events.

Host-to-host internal traffic verification is handled by connection events or network discovery features, not Security Intelligence Events, which focus on external threat reputation.