I have submitted some requests in the past. I understand that these take time for a look up. I honestly think that some effort should be focused on the life of a particular threat. What I mean by this is, if a threat existed either via a malware issue on an URL, or even a vulnerability, these should be eventually dropped. ISP's over time will clear out the bad stuff, and vulnerabilities are often superseded, with another patch taking its place. Some of the IPS rules can exceed 50,000. I often wonder how many of these can actually be archived to reduce the workload both in human form as well as electronically. I realize that since Cisco and Snort merged new technologies come. The FMC is being slowly tuned to Cisco's way of doing business, and although it will take time, there are some discrepancies I don't care for. Take for one instance - Virus Total. If Virus Total shows ONE out 60+ vendors, it's considered malware related URL/ IP. Sure there is always "more to this", but the endpoint analyst doesn't have access to all the intelligence, and we can only assume that what Cisco/ Talos says is gospel. It's a constant battle everyday to sift through all these ones and zeroes. RONCO has to have a better way out there. Does this company have the edge? a solution? Who knows......

https://www.csoonline.com/article/3289706/security/review-zero-tolerance-malware-and-code-blocking-with-solebit.html#tk.rss_news