There's no reason that you can't just download and install
Snort on Mac OS X. But if you don't want to install the development system,
or never seem to have luck compiling from source,
is a Mac GUI front end. As HenWen also includes a snort binary,
you could also install HenWen just to get that and throw the rest of it
The GUI interface does have it's attractions, though. It's much
easier to turn rules on and off with a click than to hunt them down
in the /etc/snort/rules directory. It actually just presents
the rules in the sections as they actually
are in /HenWen.app/Contents/Resources/rules,
and doesn't give you access to individual lines.. You can
add new rules easily enough, although you don't really write them
here: you point HenWen at a text file you have created by some other
means. Writing Snort rules is not the easiest task, and requires
detailed knowledge of the protocols you are trying to watch, as
well as knowledge of Snort's rule keywords and arguments. For most
of us, that means we probably downloaded a rule someone else
wrote. We'd then point HenWen at it.
For real-time alerts, HenWen includes an application
called LetterStick, which normally runs as a daemon and appears
as a small icon in your menu bar. If Snort triggers an alert, and
HenWen is configured to log to LetterStick, an alert box will
pop up on your console. It helpfully includes a "What's This?"
button which will take you to a Snort page that explains
what the alert may mean.
If you just want to use snort directly, copy the binary from
/Applications/HenWen.app/Contents and use it directly. Snort
isn't particularly difficult to use - HenWen doesn't install
a man page but there are plenty of on-line resources at http://www.snort.org if you prefer more direct control.