Cisco Cisco Firepower Management Center 4000

Do not create a rule that includes only one 

content

 keyword if that keyword has the 

 option selected. 

You may invalidate your intrusion policy. For more information, see 

.

For example, SMTP rule 1:2541:9 includes three 

content

 keywords, one of which has the 

 option 

selected. A custom rule based on this rule would be invalid if you removed all of the 

content

 keywords 

except the one with the 

 option selected. Adding such a rule to your intrusion policy could invalidate 

the policy.

Admin/Intrusion Admin

Select the 

 check box for the 

content

 keyword you are adding.

You cannot select the 

 check box and the 

 check box with the same 

content

 keyword.

Include in the rule at least one other 

content

 keyword that does not have the 

 option selected.

Continue with creating or editing the rule. See 

, 

, 

, or 

 for 

more information.

Protection

You can use either of two 

content

 location pairs to specify where to begin searching for the specified 

content and how far to continue searching, as follows:

Use 

 and 

 together to search relative to the beginning of the packet payload.

Use 

 and 

 together to search relative to the current search location.

When you specify only one of a pair, the default for the other option in the pair is assumed.

You cannot mix the 

 and 

options with the 

 and 

 options. For example, you cannot 

pair 

 and 

. You can use any number of location options in a rule.

When no location is specified, the defaults for 

 and 

 are assumed; that is, the content search 

starts at the beginning of the packet payload and continues to the end of the packet.

You can also use an existing 

byte_extract

 variable to specify the value for a location option. See 

 for more information.

Specifies in bytes where in the packet payload to start searching for content relative to the beginning 
of the packet payload. You can specify a value of-65535 to 65535 bytes.

Because the offset counter starts at byte 0, specify one less than the number of bytes you want to 
move forward from the beginning of the packet payload. For example, if you specify 7, the search 
begins at the eighth byte.