From 062d9ea9fdab8c7d4914afa464fb83315e939ec3 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Thu, 9 Nov 2023 06:22:55 -0500 Subject: [PATCH] doc/transform: Document case-changing transforms. Issue: 6439 (cherry picked from commit 9ee55d23949a1bb42e6b48429d720fcc6c15147b) --- doc/userguide/rules/transforms.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst index fecd1c537b..0067ace1de 100644 --- a/doc/userguide/rules/transforms.rst +++ b/doc/userguide/rules/transforms.rst @@ -68,6 +68,18 @@ compress_whitespace Compresses all consecutive whitespace into a single space. +to_lowercase +------------ + +Converts the buffer to lowercase and passes the value on. + +This example alerts if ``http.uri`` contains ``this text has been converted to lowercase`` + +Example:: + + alert http any any -> any any (http.uri; to_lowercase; \ + content:"this text has been converted to lowercase"; sid:1;) + to_md5 ------ @@ -79,6 +91,18 @@ Example:: alert http any any -> any any (http_request_line; to_md5; \ content:"|54 A9 7A 8A B0 9C 1B 81 37 25 22 14 51 D3 F9 97|"; sid:1;) +to_uppercase +------------ + +Converts the buffer to uppercase and passes the value on. + +This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO LOWERCASE`` + +Example:: + + alert http any any -> any any (http.uri; to_uppercase; \ + content:"THIS TEXT HAS BEEN CONVERTED TO UPPERCASE"; sid:1;) + to_sha1 --------- -- 2.47.2