Cisco Cisco Firepower Management Center 4000

.

R

Searches for matching content relative to the end of the last match found by the rules engine.

B

Searches for the content within data before it is decoded by a preprocessor (this option is similar to using the 

Raw 

Data 

argument with the 

content

 keyword).

U

Searches for the content within the URI of a normalized HTTP request message decoded by the HTTP Inspect 
preprocessor. Note that you cannot use this option in combination with the 

content

 keyword 

 option to 

search the same content. See 

 for more information.

A pipelined HTTP request packet contains multiple URIs. A PCRE expression that includes the U option 
causes the rules engine to search for a content match only in the first URI in a pipelined HTTP request 
packet. To search all URIs in the packet, use the 

content

 keyword with 

 selected, either with or 

without an accompanying PCRE expression that uses the U option.

I

Searches for the content within the URI of a raw HTTP request message decoded by the HTTP Inspect 
preprocessor. Note that you cannot use this option in combination with the 

content

 keyword 

 option 

to search the same content. See 

 for more information.

P

Searches for the content within the body of a normalized HTTP request message decoded by the HTTP Inspect 
preprocessor. See the 

content

 keyword 

 option in 

 for more 

information.

H

Searches for the content within the header, excluding cookies, of an HTTP request or response message decoded 
by the HTTP Inspect preprocessor. Note that you cannot use this option in combination with the 

content

 keyword 

 option to search the same content. See 

 for more information.

D

Searches for the content within the header, excluding cookies, of a raw HTTP request or response message 
decoded by the HTTP Inspect preprocessor. Note that you cannot use this option in combination with the 

content

 

keyword 

 option to search the same content. See 

 for more 

information.

M

Searches for the content within the method field of a normalized HTTP request message decoded by the HTTP 
Inspect preprocessor; the method field identifies the action such as GET, PUT, CONNECT, and so on to take on 
the resource identified in the URI. See the 

content

 keyword 

 option in 

 for more information.

C

When the HTTP Inspect preprocessor 

 option is enabled, searches for the normalized content 

within any cookie in an HTTP request header, and also within any set-cookie in an HTTP response header when 
the preprocessor 

 option is enabled. When 

 is not enabled, searches the 

entire header, including the cookie or set-cookie data. 

Note the following:

Cookies included in the message body are treated as body content.

You cannot use this option in combination with the 

content

 keyword 

 option to search the same 

content. See 

 for more information.

The 

Cookie:

 and 

Set-Cookie:

 header names, leading spaces on the header line, and the 

CRLF

 that terminates 

the header line are inspected as part of the header and not as part of the cookie.