The http_header keyword is a content modifier that restricts the search to the
extracted Header fields of a HTTP client request or a HTTP server response (per the
configuration of HttpInspect #sub:http-inspect#4584>
As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http_header is specified.
The extracted Header fields may be NORMALIZED, per the configuration of
HttpInspect (see #sub:http-inspect#4587>
verbatim626#
This rule constrains the search for the pattern ;SPMquot;EFG;SPMquot; to the extracted Header fields of a HTTP client request or a HTTP server response.
verbatim627#
The http_header modifier is not allowed to be used with the
rawbytes modifier for the same content.