I'm pretty sure Snort has it.
Doesn't seem so, can't find a way to generate nostrconnect: url in snort. @Kieran ?