Like @Cristian Matei said, VPN load balancing is the most common method for appliances with ASA image. (It's not supported on FTD image.) Another method is round robin DNS. If you have a load balancer or "application delivery controller (ADC)" like Citrix Netscaler or F5 BigIP you may be able to put your ASAs behind it and to load balancing on the ADC. Also, depending on your deployment, Optimal Gateway Selection (OGS) is a potential option. That one is usually for organizations with their ASAs spread out in different locations geographically. ... View more

Since the Firepower is identifying it as an intrusion event it should already be blocking the destination IP address. To ascertain what might be causing it on the endpoint can be a bit more difficult. If whatever endpoint protection is not already catching it, a deeper investigation may be required. I would typically use something like SysInternals tcpview utility in Windows to determine what process (if it's not the browser) is making the connections to the address shown in the event. ... View more