From f6b21f82eea3b8459d09a27e52667e468840939c Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Thu, 9 Nov 2023 06:22:55 -0500 Subject: [PATCH] doc/transform: Document case-changing transforms. Issue: 6439 --- doc/userguide/rules/transforms.rst | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst index 91ab2ef5fc9e..dd437d77ec81 100644 --- a/doc/userguide/rules/transforms.rst +++ b/doc/userguide/rules/transforms.rst @@ -134,3 +134,23 @@ Example:: alert http any any -> any any (msg:"HTTP with xor"; http.uri; \ xor:"0d0ac8ff"; content:"password="; sid:1;) + +to_lowercase +------------ + +Converts the buffer to lowercase. + +Example:: + + alert http any any -> any any (http.uri; to_lowercase; \ + content:"|this text has been converted to lowercase|"; sid:1;) + +to_uppercase +------------ + +Converts the buffer to uppercase. + +Example:: + + alert http any any -> any any (http.uri; to_uppercase; \ + content:"|THIS TEXT HAS BEEN CONVERTED TO UPPERCASE|"; sid:1;)