A hospital runs its radiology reporting app as plain HTTP on TCP 8443. FTD is inspecting the server segment, but the app's traffic appears only as a raw TCP stream, so the HTTP decoder never normalizes requests and intrusion inspection misses header anomalies. The team wants this traffic analyzed as HTTP while the app keeps port 8443. Which network analysis policy change should the engineer make?
Select an answer to reveal the explanation.
Short Explanation
Port mappings in a network analysis policy are what tell the decoder which application to expect, so 8443 only parses as HTTP once you've declared it. It works like labeling a crate fragile before the handler picks it up. The key move is the port-to-protocol mapping.
Full Explanation
A network analysis policy is where protocol decoders and preprocessors are selected and tuned, and part of that selection is the port-to-protocol mapping that tells the engine a stream arriving on TCP 8443 should be parsed as HTTP, which enables HTTP normalization, URI parsing and header analysis for that traffic. Adding an access control rule that permits and logs the port only decides whether the flow is allowed and recorded, so the payload remains generic TCP from the engine's point of view. A custom intrusion rule that pattern-matches HTTP headers in the raw payload can fire on literal strings, but without the mapping the HTTP decoder never runs, so normalized headers and reconstructed requests are unavailable to it. Listing 8443 in a port list referenced by a rule simply widens that rule's match condition and has no effect on decoder selection, which lives in the analysis policy rather than in rule matching. Exam caveat: if the traffic were actually TLS, no port mapping would expose the payload and decryption would come first. Practical check: after deploying the policy, request the app and confirm the connection event reports HTTP as the application protocol.