In some cases, there is a need to block URLs that use the same domain name but have different paths. Currently, our proxy policy allows us to block entire domains, but we cannot block specific URLs with different paths.
You can use the below CPLs , as an example (can be edited as needed):
<SSL>
server.certificate.hostname.substring="example.com" Allow
<proxy>
url.domain="https://example.com/Symantec" deny
url.domain="https://example.com/microsoft" deny
Please refer also to Add CPL to a local policy file on the Edge SWG (ProxySG) (broadcom.com)
Alternatively , adding CPL using VPM: