I have found some events of type Would have dropped in ASA-Firepower FMC logs. The guide explains
The event type is always Would have dropped for packets seen while the system is pruning, regardless of deployment.
[...]
the system sometimes prunes older event details to manage disk space usage.
The module is inline and IPS policy is set to Drop when Inline so I can think of no other explanation.
Would Firepower really pass traffic matching a threat pattern while it is busy pruning?? Were these packets really not dropped?
