IPS/IDS - Firepower ( Intrusions Events )

[JRDIAZ758]

we are seeing a lot of the messages below when looking at the reports, Does anyone know what they mean? do we need to take any action

Cleared DELETED BLACKLIST DNS request for known malware domain  

[Greg Smalley]

You may have a compromised host as it appears a computer on your network is making requests to known Malware domains.  First you need to find out which hosts are making these requests.  Analysis->Intrusion Events should show you the events in question. (Be aware that it may show your local DNS server making the request on behalf of a host and not the original client who is compromised that made the request.)  After locating which IPs are compromised you should wipe those PCs/Servers or at the very least clean with AV (though the later may leave undetectable software installed.)