Cisco Cisco Firepower Management Center 4000

Protection

You can instruct the rules engine to ignore case when searching for content matches in ASCII strings. 
To make your search case-insensitive, check 

 when specifying a content search.

Admin/Intrusion Admin

Select 

for the 

content

 keyword you are adding.

Continue with creating or editing the rule. See 

, 

, 

more information.

Protection

The 

 option instructs the rules engine to analyze the original packet payload before analyzing 

the normalized payload data (data decoded by a FireSIGHT System preprocessor) and does not use an 
argument value. You can use this keyword when analyzing telnet traffic to check the telnet negotiation 
options in the payload before normalization.

You cannot use the 

 option together in the same 

content 

keyword with any HTTP content 

option. See 

 for more information.

You can configure the HTTP Inspect preprocessor 

 and 

 options to 

determine whether raw data is inspected in HTTP traffic, and how much raw data is inspected, when the 
HTTP Inspect preprocessor is enabled. For more information, see 

.

Admin/Intrusion Admin

Select the 

 check box for the 

content

 keyword you are adding.

Continue with creating or editing the rule. See 

, 

, 

more information.

Protection

Select the 

 option to search for content that does not match the specified content. If you create a rule 

that includes a 

content

 keyword with the 

 option selected, you must also include in the rule at least 

one other 

content

 keyword without the 

 option selected.