From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Thu, 9 Nov 2023 11:22:55 +0000 (-0500)
Subject: doc/transform: Document case-changing transforms.
X-Git-Tag: suricata-8.0.0-beta1~2082
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ee55d23949a1bb42e6b48429d720fcc6c15147b;p=thirdparty%2Fsuricata.git

doc/transform: Document case-changing transforms.

Issue: 6439
---

diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst
index 91ab2ef5fc..f52bac7f3e 100644
--- a/doc/userguide/rules/transforms.rst
+++ b/doc/userguide/rules/transforms.rst
@@ -68,6 +68,18 @@ compress_whitespace
 
 Compresses all consecutive whitespace into a single space.
 
+to_lowercase
+------------
+
+Converts the buffer to lowercase and passes the value on.
+
+This example alerts if ``http.uri`` contains ``this text has been converted to lowercase``
+
+Example::
+
+    alert http any any -> any any (http.uri; to_lowercase; \
+        content:"this text has been converted to lowercase"; sid:1;)
+
 to_md5
 ------
 
@@ -79,6 +91,18 @@ Example::
     alert http any any -> any any (http_request_line; to_md5; \
         content:"|54 A9 7A 8A B0 9C 1B 81 37 25 22 14 51 D3 F9 97|"; sid:1;)
 
+to_uppercase
+------------
+
+Converts the buffer to uppercase and passes the value on.
+
+This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO LOWERCASE``
+
+Example::
+
+    alert http any any -> any any (http.uri; to_uppercase; \
+        content:"THIS TEXT HAS BEEN CONVERTED TO UPPERCASE"; sid:1;)
+
 to_sha1
 ---------
 
@@ -134,3 +158,4 @@ Example::
 
     alert http any any -> any any (msg:"HTTP with xor"; http.uri; \
         xor:"0d0ac8ff"; content:"password="; sid:1;)
+