update yara template

Lowercase network transport

salt/elasticsearch/files/ingest/suricata.common

@@ -22,6 +22,12 @@
                 "ignore_failure": true
             }
         },
+        {
+            "lowercase": {
+                "field": "network.transport",
+                "ignore_failure": true
+            }
+        },
         {
             "rename": {
                 "field": "message2.in_iface",

salt/soc/defaults.yaml

@@ -2622,6 +2622,7 @@ soc:
               This is a YARA rule template. Replace all template values with your own values.
               The YARA rule name is the unique identifier for the rule.
               Docs: https://yara.readthedocs.io/en/stable/writingrules.html#writing-yara-rules
+              Delete these comments before attempting to "Create" the rule
               */
 
               rule Example // This identifier _must_ be unique