Wildfire content update has the latest threat intelligence from cloud sandboxing sent to all the firewalls that have the wildfire subscriptions. Even before the threat gets widespread we can protect the networks with quick updates as early as next minute as soon as the verdict is finalized. Always make sure the action is set to "download-and-install" and recurrence for every 1 minute so the new content update takes effect. If there is no new WF signatures on the update server the firewall will just keep checking for updates every minute as against every 15 mins in prior setting. Only when the content is available the next minute query would download the content update.