HTTP_REQUEST and POSTs

That will tell you whether it is a POST request or not. If you want to act on the data within the POST, you will have to issue a collect and work with the HTTP::payload value in the HTTP_REQUEST_DATA event.

Something like this should get you started:

when HTTP_REQUEST {
  if { [HTTP::method] equals "POST" } {
    if { [HTTP::header exists "Content-Length"] } {
      set content_length [HTTP::header "Content-Length"]
    } else {
      set content_length 4294967295
    }
    if { $content_length > 0 } {
       this will trigger the HTTP_REQUEST_DATA event when all the
       POST data has arrived.
      HTTP::collect $content_length
    }
  }
}
when HTTP_REQUEST_DATA {
   check the HTTP::payload for it's contents.
  if { [HTTP::payload] contains "somevalue" } {
     do something here...
  }
}