lowercase causes missed detections and broken searches #18154
Description
In the Zeek HTTP file, there is a lowercasing of http.request.method - shown here:
http.request.method will have values of POST, GET, OPTIONS, etc... the vast majority of dashboards, visualizations, searches, threat hunts, etc.. are all built on how the vast majority of HTTP requests work ie: the value of GET for outbound stuff or POST for inbound web attacks.
couple this with values being case sensitive, there is no even "fail safe" that would have made this not such an impactful thing.
also, this field can be used for anomalous variations of the above, such as looking for PoST.