Cisco Cisco Firepower Management Center 4000

You would not use this option when the rule contains other conditions relative to the specified content. 
For example, you would not use this option to search for the content 

1234

 if another rule condition sought 

to determine if 

abcd

 occurs before 

1234

. In this case, the rules engine could not determine the relative 

location because specifying 

 instructs the rules engine not to search for the 

specified content.

Note the following conditions when using this option:

The specified content is location-independent; that is, it may occur anywhere in the payload; thus, 
you cannot use positional options (

, 

, 

, 

, or 

).

You cannot use this option in combination with 

.

You cannot use this option in combination with 

.

The specified content will be treated as case-insensitive, because all patterns are inserted into the 
fast pattern matcher in a case-insensitive manner; this is handled automatically, so it is not necessary 
to select 

 when you select this option.

You should not immediately follow a 

content

 keyword that uses the 

option 

with the following keywords, which set the search location relative to the current search location:

isdataat

pcre

content

 when 

 or 

 is selected

content

 when 

 is selected

asn1

byte_jump

byte_test

byte_extract

base64_decode

The 

 option allows you to specify a portion of the content to search. 

This can reduce memory consumption in cases where the pattern is very long and only a portion of the 
pattern is sufficient to identify the rule as a likely match. When a rule is selected by the fast pattern 
matcher, the entire pattern is evaluated against the rule. 

You determine the portion for the fast pattern matcher to use by specifying in bytes where to begin the 
search (offset) and how far into the content (length) to search, using the syntax:

offset,length

For example, for the content:

1234567

if you specify the number of offset and length bytes as:

1,5

the fast pattern matcher searches only for the content 

23456

.

Note that you cannot use this option together with 

.

Admin/Intrusion Admin

Select 

 for the 

content

 keyword you are adding.