Is it possible to match the TLS SNI field on a Cisco ASA without Firepower?

Just curious if this is possible, might make for very effective on-off SSL filtering without Firepower.

This is purely hypothetical so no tangents on design please...