Cisco Cisco Firepower Management Center 4000

Select this option to search for content matches in the request method field, which identifies the 
action such as GET and POST to take on the resource identified in the URI.

Select this option to search for content matches in the normalized header field, except for cookies, 
in HTTP requests; also in responses when the HTTP Inspect preprocessor 

 

option is enabled.

Note that you cannot use this option in combination with the 

pcre

 keyword HTTP header (H) option 

to search the same content. See the 

 table for more 

information.

Select this option to search for content matches in the raw header field, except for cookies, in HTTP 
requests; also in responses when the HTTP Inspect preprocessor I

 option is 

enabled.

Note that you cannot use this option in combination with the 

pcre

 keyword HTTP raw header (D) 

option to search the same content. See the 

 table 

for more information.

Select this option to search for content matches in any cookie identified in a normalized HTTP client 
request header; also in response set-cookie data when the HTTP Inspect preprocessor 

 option is enabled. Note that the system treats cookies included in the message body as 

body content.

You must enable the HTTP Inspect preprocessor 

 option to search only the 

cookie for a match; otherwise, the rules engine searches the entire header, including the cookie. See 

 for more information.

Note the following:

You cannot use this option in combination with the 

pcre

 keyword HTTP cookie (C) option to 

search the same content. See the 

 table for 

more information.

The 

Cookie:

 and 

Set-Cookie:

 header names, leading spaces on the header line, and the 

CRLF

 

that terminates the header line are inspected as part of the header and not as part of the cookie.

Select this option to search for content matches in any cookie identified in a raw HTTP client request 
header; also in response set-cookie data when the HTTP Inspect preprocessor 

 

option is enabled; note that the system treats cookies included in the message body as body content.

You must enable the HTTP Inspect preprocessor 

 option to search only the 

cookie for a match; otherwise, the rules engine searches the entire header, including the cookie. See 

 for more information.

Note the following:

You cannot use this option in combination with the 

pcre

 keyword HTTP raw cookie (K) option 

to search the same content. See the 

 table for 

more information.