Are you asking who is using facebook so much?
For that, as well as the IP addresses used by facebook, you would do a query of your connection events. Open up the time period (default is past hour) and filter the URL field on *.facebook.com. Execute the query and you will see the source IP and destination IP addresses.
If you have integrated your internal users' identity via Cisco FirePOWER User Agent or such, you will also get the users' AD name.
