Snort is the IPS running on firepower. Depending on your firewall model the number of snort processes varies.
To understand why this process is at 100% you might want to understand traffic forwarding on the firepower module. Based on a hash (5-tuple) traffic is being processed by a specific snort process, which uses one assigned CPU.
In case you have an elephant flow (large amounts of data being sent/received over a single session) this might lead to high load on a specific CPU. This is by itself not an issue but might lead to performance degradation for other sessions.
If you want to restart snort you will most likely encounter some traffic loss so keep this in mind and do not casually restart it at 09:00 am on your active firewall. ;)
Procedure to restart snort (on sfr module / ftd)
> expert
admin@firepower:~$ sudo pmtool restartByType snort
Try to identify the flow causing the high load (backup/ftp traffic?) and exclude it from inspection by either using a pre-filter policy (FTD) or excluding it from inspection using your service-policy (asa with firepower services)
Let me know if this answers your question
