I have some questions about how fast_pattern and prefilter are used.
Is fast_pattern only used with the payload keyword 'content? The Suricata 6.00 user guide says that the prefilter engines for other non-MPM keywords can be enabled in specific rules by using the ‘prefilter’ keyword.
Which keywords are non-MPM?
Is the payload keyword ‘content’ a MPM keyword? What are other MPM keywords?
I will appreciate very much if someone can provide information for my questions.