Explanation
The content keyword is used to specify a string or pattern to search for in the payload or stream of a packet.
The string must be enclosed in quotation marks and can use modifiers such as nocase, depth, offset, and so on.
The string can also use hexadecimal notation by using a pipe symbol (|) before and after the hexadecimal characters. For example, content:"|45 5* 26 27 4 0A|" will match any payload or stream that contains the hexadecimal bytes 45 5 26 27 4 0A followed by any number of bytes2

Section: Configuration
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide- v60/Access_Control_Using_Intrusion_and_File_Policies.html

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config- guide-v60/Application_Layer_Preprocessors.html

https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/firewall/asa-910-firewall-config
/access-sfr.html
Inline tap monitor-only mode (ASA inline)-In an inline tap monitor-only deployment, a copy of the traffic is sent to the ASA FirePOWER module, but it is not returned to the ASA. Inline tap mode lets you see what the ASA FirePOWER module would have done to traffic, and lets you evaluate the content of the traffic, without impacting the network. However, in this mode, the ASA does apply its policies to the traffic, so traffic can be dropped due to access rules, TCP normalization, and so forth.

https://community.cisco.com/t5/network-security/adding-eigrp-to-ftd-using-fmc/td-p/4284529