Cisco Cisco Firepower Management Center 2000

Continue with creating or editing the rule. See 

 for more information.

Protection

HTTP 

content

 keyword options let you specify where to search for content matches within an HTTP 

message decoded by the HTTP Inspect preprocessor.

Two options search status fields in HTTP responses:

Note that although the rules engine searches the raw, unnormalized status fields, these options are listed 
here separately to simplify explanation below of the restrictions to consider when combining other raw 
HTTP fields and normalized HTTP fields.

Five options search normalized fields in HTTP requests, responses, or both, as appropriate (see 

 for more information):

Three options search raw (unnormalized) non-status fields in HTTP requests, responses, or both, as 
appropriate (see 

 for more information):

Use the following guidelines when selecting HTTP 

content

 options:

HTTP 

content

 options apply only to TCP traffic. 

To avoid a negative impact on performance, select only those parts of the message where the 
specified content might appear.

For example, when traffic is likely to include large cookies such as those in shopping cart messages, 
you might search for the specified content in the HTTP header but not in HTTP cookies.

To improve performance and reduce false positives, ensure that the HTTP Inspect preprocessor is 
enabled so HTTP message traffic can be normalized and evaluated against rules that include HTTP 

content

 options.

To take advantage of HTTP Inspect preprocessor normalization, and to improve performance, any 
HTTP-related rule you create should at a minimum include at least one 

content

 keyword with an 

, 

, 

, or 

 option selected.

You cannot use the 

replace

 keyword in conjunction with HTTP 

content

 keyword options.

You can specify a single normalized HTTP option or status field, or use normalized HTTP options and 
status fields in any combination to target a content area to match. However, note the following 
restrictions when using HTTP field options: