You actually have it all set up fine.  The Liveupdate is only giving you information from the GIN datafeeds (vulnerability and malcode and point product signature data).  This data is being used for Incident and archive declaration.  The Intelligence tab on the SSIM appliance is populated from a webfeed from the Threat Management System portal itself.  It cannot be updated through liveupdate, and if you cannot connect to the internet you cannot get the information from the webfeed. So you will only ever see demo data on this tab.  To confirm you have the Liveupdate properly applied, you want to go to the administration webpage, select "GIN Configuration" - The dates on the datafeed should have the previous month date as listed in the LU release notes file. (The liveupdate packages are built on the 25th of the month usually)