All firewall rules are applied prior to sending the packets to the SSM.

So if the packet will be dropped by a firewall rule, then the packet will not be sent to the SSM.

If the packet will be modified by a firewall rule, then the modification will be done before being sent to the SSM.

There are only two exceptions, and that is encryption and ultimate transmit of the packet.

Encryption happens after being sent to the SSM, so the SSM alway sees unencrypted traffic (where the ASA is the encryption tunnel end point).

And of course transmit of the packet by the ASA through its external interfafes happens after sending to the SSM.

In the case of promiscuous monitoring by the SSM, the encryption and transmit happen right after a copy is sent to the SSM.

In the case of inline monitoring by the SSM, the encryption and transmit happen only after the SSM has completed its analysis and the packet was not denied by the SSM.