FMC's Security Intelligence and Access Control

[Will Kirk]

Howdy y'all,

We've recently installed FPR1140's, managed by CDO, and we make use of blocking certain Talos' Categories (Malware, Malicious, Phishing, etc).

I understand that the Security Intelligence process is before the Access Rules, and that SI can block a URL or network list, while the Access Rules only have access to the URL list.

But is there a difference, for example, between the "Malicious" category found on SI, vs the "Malicious" category found on the Access Rules?

What is best-practice for blocking networks/URL's with these 2 options?

Thanks in advance.

[MHM Cisco World]

Access Rules, and that SI can block a URL or network list, while the Access Rules only have access to the URL list. <<- this not correct

Now regarding ACP URL and SI URL.

SI url for all bad url' like adult' gambling..etc. 

ACP URL is good known url like Facebook' goolge..etc..

So for Bad we know we need to deny it' but what about good known url?

Will' assume your company want to deny all social media but allow only Facebook' here we use ACP URL.

Thanks 

MHM