Suricata

Do you mean the hostname/sni ?

Because you already have quic.sni hoisted up even if you can see it also in the array of extensions

  "quic": {
    "version": "1",
    "sni": "msquic.net",
    "ja3": {
      "hash": "292bd0719190dff4cb1033de8573310d",
      "string": "771,4865-4866-4867,51-0-16-43-13-10-57-45-41,23-29," 
    },
    "extensions": [
      {
        "name": "key_share",
        "type": 51
      },
      {
        "name": "server_name",
        "type": 0,
        "values": [
          "msquic.net" 
        ]
      },
      {
        "name": "alpn",
        "type": 16,
        "values": [
          "h3-29" 
        ]
      },