Configuration
1-Copy the default configuration file from the package into the /etc/snort directory:
cp ./etc/* /etc/snort/
2-Edit /etc/snort/snort.conf and make the following changes:
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules
3-Uncomment the Unified2 output line and remove nostamp from the comma-delimited options list:
output unified2: filename merged.log, limit 128, mpls_event_types, vlan_event_types
How can I type "Edit /etc/snort/snort.conf " on Mac terminal and type inside
var RULE_PATH /etc/snort/rules,
var SO_RULE_PATH /etc/snort/so_rules,
var PREPROC_RULE_PATH /etc/snort/preproc_rules,
var WHITE_LIST_PATH /etc/snort/rules,
var BLACK_LIST_PATH /etc/snort/rules,
although I tried many times but invain ?Screenshot attached file