The http_header keyword is a content modifier that restricts the search to the extracted Header fields of a HTTP client request or a HTTP server response (per the configuration of HttpInspect 2.2.6).
As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http_header is specified.
The extracted Header fields may be NORMALIZED, per the configuration of HttpInspect (see 2.2.6).