URL filtering is for acceptable use enforcement. Hence you won't see malicious URLs categorized in URL filtering categories. For security, the WSA provides multiple layers of defense. The malicious URLs and content are identified and blocked using Web Reputation Filters, AV Signatures scanning with multiple signature sets in parallel and using L4TM, the layer 4 traffic monitor across all ports to block internal traffic reaching out to malicious destinations. In a nutshell, URL filtering works great for enforcing acceptable use policies, but for security web reputation works much better due to its wider coverage and proactive nature.
... View more
As the earlier post indicated, existing customers who are using IronPort URL Filters (IPURL) can get a license at no additional cost for Web Usage Controls, the new product recently launched on the WSA which provides URL filtering coupled with dynamic categorization. Simply send an email to your Cisco IronPort account manager with this request and your appliance serial numbers. Once the license is available on the WSA, you will be able to activate Web Usage Controls and migrate your policies to the URL categories that come with this product. Web Usage Controls includes a category for "Social Networking" which is not available in IPURL.
... View more