I came across a configuration guide which mentions, in the Intrusion Policies chapter, GID 2 as " Tagged Packets. (Rules for the Tag generator, which generates packets from a tagged session. )"
https://www.cisco.com/c/en/us/td/docs/security/firepow...