How to check if response contains a specific string using IRules

So a few more details of what you're trying to do would help, but you can start here and see where you get to. This is some code that modifies a jsession cookie and persists on it. If you can give some more info, might be able to get a bit closer to what you're trying to do.

when HTTP_REQUEST {

 Check if cookie has a value
if {[HTTP::cookie "JSESSIONID"] ne ""}{
     Parse the three ! delineated fields from the cookie
    if {[scan [HTTP::cookie JSESSIONID] {%[^:]:%[^:]:%[^:]} session holder pri_server_hash] == 3}{
        HTTP::cookie value "JSESSIONID" "$session:$holder"
         Persist off of the primary server token if it is present, not a null value and has a current persistence record
        if {$pri_server_hash ne ""}{
            persist uie $pri_server_hash
        }
    }
}
}

when HTTP_RESPONSE {

 Check if cookie has a value
if {[HTTP::cookie "JSESSIONID"] ne ""}{

     Parse the second field of the cookie value.
      The current server always sets its hash as the primary server hash in the second field of the cookie.
    set jsession [HTTP::cookie "JSESSIONID"]
    append jsession ":[IP::remote_addr]"
    HTTP::cookie value "JSESSIONID" $jsession

    persist add uie [IP::remote_addr]
}
}

I may be interpreting your requirement a little differently, but if you're asking to change a (set)cookie value based on some matching content in the response, here's an option:

when HTTP_RESPONSE {
    if { [HTTP::header Content-Type] contains "text" } {
        HTTP::collect [HTTP::header Content-Length]
    }
}
when HTTP_RESPONSE_DATA {
    if { [HTTP::payload] contains "diam" } {
        if { [HTTP::cookie exists JSESSIONID] } {
            HTTP::cookie value JSESSIONID "foobar"
        }
    }
}

This can get tricky based on where you might find this data and how large the response payload is. Collecting all of the response payload can cause a performance hit.