Feature #7672
open
detect/transforms: subslice transform
Added by Philippe Antoine about 2 months ago.
Updated 5 days ago.
Description
Many keyword use offset and bytes
We could make it more generic with a subslice transform that would take a subslice of a sticky buffer
like http.uri; subslice: [2: -2]; content: "toto";
Need to think about all the expressivity we want (negative indexing, relative ? etc...)
- Tracker changed from Bug to Feature
I'd prefer to support:
bytes
Number of bytes to sliceoffset
Where to begin the slice
Jeff Lucovsky wrote in #note-2:
I'd prefer to support:
- [...] Number of bytes to slice
- [...] Where to begin the slice
Fine for me
I do not care so much about the syntax than about the expressivity (like negative indexing to start from the end)
Also available in: Atom
PDF