OK,
I have looked into this again and found that using Stream might be the best option, so what I have so far is:
when HTTP_RESPONSE {
Disable the stream filter by default
STREAM::disable
Check if response type is text
if {[HTTP::header value Content-Type] contains "text" and [HTTP::header "User-Agent"] contains "***"}{
Replace
STREAM::expression "@123@xyz@ @456@xyz@"
Enable the stream filter for this response only
STREAM::enable
}
}
However I also need to check the uri as I only want to replace on certain areas. How can I do this? Can I use HTTP_REQUEST with the HTTP_RESPONSE?