From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Thu, 9 Nov 2023 11:22:55 +0000 (-0500)
Subject: doc/transform: Document case-changing transforms.
X-Git-Tag: suricata-7.0.3~47
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=062d9ea9fdab8c7d4914afa464fb83315e939ec3;p=thirdparty%2Fsuricata.git

doc/transform: Document case-changing transforms.

Issue: 6439
(cherry picked from commit 9ee55d23949a1bb42e6b48429d720fcc6c15147b)
---

diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst
index fecd1c537b..0067ace1de 100644
--- a/doc/userguide/rules/transforms.rst
+++ b/doc/userguide/rules/transforms.rst
@@ -68,6 +68,18 @@ compress_whitespace
 
 Compresses all consecutive whitespace into a single space.
 
+to_lowercase
+------------
+
+Converts the buffer to lowercase and passes the value on.
+
+This example alerts if ``http.uri`` contains ``this text has been converted to lowercase``
+
+Example::
+
+    alert http any any -> any any (http.uri; to_lowercase; \
+        content:"this text has been converted to lowercase"; sid:1;)
+
 to_md5
 ------
 
@@ -79,6 +91,18 @@ Example::
     alert http any any -> any any (http_request_line; to_md5; \
         content:"|54 A9 7A 8A B0 9C 1B 81 37 25 22 14 51 D3 F9 97|"; sid:1;)
 
+to_uppercase
+------------
+
+Converts the buffer to uppercase and passes the value on.
+
+This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO LOWERCASE``
+
+Example::
+
+    alert http any any -> any any (http.uri; to_uppercase; \
+        content:"THIS TEXT HAS BEEN CONVERTED TO UPPERCASE"; sid:1;)
+
 to_sha1
 ---------