An engineer is configuring a custom intrusion rule on Cisco FMC.

The content keyword is used to specify a string or pattern to search for in the payload or stream of a packet. The string must be enclosed in quotation marks and can use modifiers such as nocase, depth, offset, and so on. The string can also use hexadecimal notation by using a pipe symbol (|) before and after the hexadecimal characters. For example, content:"|45 5* 26 27 4 0A|" will match any payload or stream that contains the hexadecimal bytes 45 5 26 27 4 0A followed by any number of bytes2