Thanks!
One approach would be a VPN qube will send the traffic to an external exit gateway for inspection. Otherwise I’m afraid the battery life with Snort or Suricata will be bad (and I’m not sure they can do something like that, as with crowd strike or ZScalar).
In this case, it will not be related to Qubes.