I try search my patter in HTML Form URL Encoded: application/x-www-form-urlenencoded with keyword pcre and can’t match. But when i use http.request_body; + pcre match okey. What workarounds are there so as not to use http.request_body in my rule?
For example I won’t use old ver keyword http_request_body.
Please share some details, like the rule, a pcap to show the problem, etc.