Suricata

1. flip the proto to the end

- this complicates the naming a little
- breaks the current "proto_buffer"; naming scheme

uri_http;
header_http;
user_agent_http;

2. use similar naming to 'raw'

- a little more typing
- looks fairly similar to what we already have

http_sticky_uri;
http_sticky_header;
http_sticky_user_agent;
http_raw_sticky_uri; - in instances where we have raw

3. put sticky at the end

- not a naming convention we have currently

http_uri_sticky;
http_header_sticky;
http_user_agent_sticky;

4. let suricata decide the function of the buffer

- this could possibly complicate the engine's parsing of the rules
- cleanest

content:"/example/"; http_uri; (old - modifier)
http_uri; content:"/example/"; (new - sticky)

After some time thinking about this, perhaps the initial 'http_' portion of the buffer name is not needed?

our rule is already 'alert http...'

http_uri; -> uri;
http_user_agent; -> user_agent;
http_referer; -> referer;