Could one mirror the traffic from the VM into Suricata/Snort to analyse it? Although if it were to be HTTPS traffic I doubt these or Wireshark would be able to do anything about them. The only alternative remains is to run a MiTM proxy in your network, which is a bit more advanced