When Sourcefire sees a URL in an email, does it follow the URL as part of the IPS function (i.e. for reputational assesment). If so, can this be disabled in any way other than disabling the URL filtering as a whole ?
URL Filtering is limited to web traffic. It will not trigger on email payload. Anti-Spam / E-Mail Protection should be done on an email security appliance that can receive email and remove malicious content.
