Summary:

  1. Create an anti-spyware profile

    • enable DNS sinkhole feature

  2. Attach it to a security policy  

sinkhole address:

  • ​an infected host attempts to resolve a malicious domain to a fake IP you defined (sinkhole address, make sure it's not on your network)

Note, to see all spyware names, check "Show all signatures" button

Assign an invalid sinkhole IP