We set an event if they are different: app-layer-event:http.host_header_ambiguous;, so it's probably safe to check just one.