Feature #6439: New Transformation: to_lowercase - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #6439

closed

New Transformation: to_lowercase

Added by Brandon Murphy about 1 year ago. Updated almost 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Jeff Lucovsky

Target version:

8.0.0-beta1

Effort:

Difficulty:

Label:

Description

Hoping to get a to_lowercase transformation that can be combined with others. The use case is to allow for the "normalization" of a mixed case URL to lowercase. This would allow the url to be obfuscated and account for multiple variations of casing within the field.

http.uri; to_lowercase; to_sha256; content:"<sha256 digest>";

Subtasks 1 (0 open — 1 closed)

Actions

Copy link

Updated by Victor Julien about 1 year ago

Status changed from New to Assigned
Assignee changed from OISF Dev to Jeff Lucovsky
Target version changed from TBD to 8.0.0-beta1

@Brandon Murphy would you see value in a "to_uppercase" as well?

@Jeff Lucovsky we can probably target 7 as well, as there should be no side effects of adding this.

Actions

Copy link

Updated by Brandon Murphy about 1 year ago

@Brandon Murphy would you see value in a "to_uppercase" as well?

I cannot currently think of any use cases for that. If it's only a trivial amount of additional work, then why not include it? I'd much rather have it and not need it than the other way around.

Actions

Copy link

Updated by Jeff Lucovsky about 1 year ago

Status changed from Assigned to In Progress

Actions

Copy link

Updated by Brandon Murphy about 1 year ago

just wanting to mention, this transformation could be used to address case differences between HTTP/1 and HTTP/2 assuming content matches can be updated/change to reflect the transformation behavior.

Actions

Copy link