Suricata

Many keyword use offset and bytes

We could make it more generic with a subslice transform that would take a subslice of a sticky buffer

like http.uri; subslice: [2: -2]; content: "toto";

Need to think about all the expressivity we want (negative indexing, relative ? etc...)