Yes,

The spyware filter is part of the protocol analyzer add-on. It works wonderfully for *blocking* spyware traffic on your network but it beats the piss out of your logging server (logging *tons* of hits). The good news is you'll instantly know who to visit in order to clean the machine and yell about filling out online prize apps.

The policy manager is very good too. You can allow/disallow certain traffic based on time of day, user, group, etc.

Hope I answered what you need.