Suricata

A transform that could combine existing sticky buffer values according to a format string in a transform would provide a power facility to shift rules based on specific hosts/path combinations into a dataset and hence, craft a rule like the following:

alert http any any -> any any (format("{}/{}", http.host, http.uri); dataset: isset, url-bl;)

The values for http.host and http.uri are combined into a string, eg., http://somehost/some/path/that/is/suspicious.

The format transform generates the string and then it's checked against a URL blacklist.