The AIP-SSM (IPS runnning on the SSM module inside an ASA) is capable of doing both inline (IPS) and promiscuous (IDS) monitoring.
When configuring the ASA itself you will create a security policy (usually making changes to your existing policy) and can specify which class of traffic will be monitored inline using the "ips inline fail-open|fail-close" command, and which class of traffic will be monitored promiscuously using the "ips promiscuous fail-open|fail-close" command.
When traffic matches those classes, then the ASA will send the packets to the AIP-SSM with a special header to tell the AIP-SSM whether the packet should be monitored inline or promiscuous.
The IPS running on the AIP-SSM is a fully featured IPS running the same software and using the same upgrades as the IPS Appliances.
The only limitations on the AIP-SSM is that the Normalizer Engine on the AIP-SSM is not used because those features are already built into the ASA itself and so are not needed on the AIP-SSM, and the Atomic ARP engine is not used because the ASA itself handles the ARP packets and does not copy them to the AIP-SSM.
