@@ -214,9 +214,7 @@ rules:
214214Match provides the pattern to match the target against. You can combine it with a [`transform`](#transform).
215215
216216- _(mandatory)_ `match` containing both :
217-
218217 - _(mandatory)_ `type` indicates the matching method, one of :
219-
220218 - `regex` : matches _target_ against value (_value_ is a RE2 regexp)
221219 - `equals` : _target_ is a string equal to _value_
222220 - `startsWith` : _target_ starts with _value_
@@ -259,14 +257,47 @@ Optional operations applied to the target before matching:
259257
260258- ` lowercase`
261259- ` uppercase`
262- - `b64decode` : base64 decode
263260- `length` : transform _target_ to a number representing the string's length
264- - `urldecode` : URL decode
265- - `trim` : remove leading and trailing spaces
266- - `normalizepath` : normalize the path (remove double slashes, etc)
267- - `htmlEntitydecode` : decode HTML entities
268261- `count` : number of times the _target_ appears
269262
263+ **Trim:**
264+
265+ - `trim` : remove leading and trailing spaces
266+ - `trim_left` : remove leading spaces
267+ - `trim_right` : remove trailing spaces
268+
269+ **Decoding:**
270+
271+ - `htmlentitydecode` : decode HTML entities
272+ - `js_decode` : decode JavaScript escape sequences
273+ - `css_decode` : decode CSS escape sequences
274+ - `urldecode` : URL decode
275+ - `hexdecode` : hex decode
276+ - `cmdline` : decode common command-line obfuscation techniques
277+
278+ **Base64:**
279+
280+ - `b64decode` : strict base64 decode
281+ - `b64decode_lenient` : lenient base64 decode (no padding required, decodes up to first invalid character, skips whitespaces and dots)
282+ - `b64encode` : base64 encode
283+
284+ **Path normalization:**
285+
286+ - `normalize_path` (or `normalizepath`) : normalize the path (remove double slashes, etc)
287+ - `normalize_path_win` (or `normalizepathwin`) : normalize the path for Windows (handles backslashes)
288+
289+ **Whitespace and nulls:**
290+
291+ - `remove_whitespaces` : remove all whitespace characters
292+ - `compress_whitespaces` : compress multiple whitespace characters into one
293+ - `remove_nulls` : remove null bytes
294+ - `replace_nulls` : replace null bytes with spaces
295+
296+ **Comments:**
297+
298+ - `remove_comments` : remove common comment sequences (e.g. `/* ... */`, `//`, `#`, `--`)
299+ - `replace_comments` : replace comment sequences with a space
300+
270301` ` ` yaml {5-6}
271302name: crowdsecurity/example-rule
272303rules:
0 commit comments