anchor.diff:  |     Module|core
   |    Version|0.3
   |===============================================================================
  +
  +==== strmatch
  +[cols=">h,<9"]
  +|===============================================================================
  +|Description|Returns true if the target is in the set of whitespace separated values.
  +|     Syntax|`strmatch <value1 value2 ... valueN>`
  +|      Types|String
  +|     Module|core
  +|    Version|0.10
  +|===============================================================================
  +
  +This is nearly identical to the <<_match>> operator, but uses the string set instead of a hash as the underlying implementation. For larger sets of words this may be a better choice, but does not offer a case insensitive version, so you would need to do a <<_lowercase>> transformation or similar.
  +
  +==== strmatch_prefix
  +[cols=">h,<9"]
  +|===============================================================================
  +|Description|Returns true if a prefix of the target is in the set of whitespace separated values.
  +|     Syntax|`strmatch_prefix <value1 value2 ... valueN>`
  +|      Types|String
  +|     Module|core
  +|    Version|0.10
  +|===============================================================================
  +
  +This is similar to the <<_strmatch>> operator, but is a longest prefix match instead of a full match.
  +
  +NOTE: The longest prefix in the set is added to the CAPTURE collection if there is a match.
   
   ==== true
   [cols=">h,<9"]
  
positive.code:      capture event block:phase
  ----
  
  ==== is_xss
  [cols=">h,<9"]
  |===============================================================================
  
negative.code: ----
  Rule ARGS @is_xss default id:test/xss/1 phase:REQUEST "msg:Detected XSS" logdata:%{FIELD} event block:phase
  ----
  
  ==== istreq
  [cols=">h,<9"]
  