Deploy snort with CFEngine on FreeBSD. Use standard Masterfiles repo and place it in services/autorun/. Staging-Files for templates left as an excercise.

snort.cf

bundle agent snort
{
  meta:
      "tags"             slist => { "autorun" };

  vars:
    linux::
      "snort_package"                   string => "snort";
      "snort_dir"                       string => "/etc/snort/";
      "snort_path"                      string => "/usr/bin/snort";
      "pulledpork_dir"                  string => "/etc/pulledpork/";
      "pulledpork_reload"               string => "/usr/bin/pulledpork.pl";
      
    freebsd::
      "snort_package"                   string => "snort";
      "snort_dir"                       string => "/usr/local/etc/snort/";
      "snort_path"                      string => "/usr/local/bin/snort";
      "snort_rules_script"              string => "/etc/periodic/daily/900.update-snort";
      "pulledpork_dir"                  string => "/usr/local/etc/pulledpork/";
      "pulledpork_reload"               string => "/usr/local/bin/pulledpork.pl";
      "rc_conf[snort_enable]"           string => "\"YES\"";
      "rc_conf[snort_interface]"        string => "\"$(interface)\"";

    my_snort_host::
      "interface"                       string => "em1";

  classes:
      "snort_host"          or => {
                                    classify("my_snort_host")
      };

    snort_host::
      "snort"       expression => isvariable("snort.interface");

  packages:
    snort::
      "$(snort_package)"
        handle          => "install_package_snort",
        comment         => "Installing snort",
        package_policy  => "addupdate",
        classes         => if_ok("have_snort_package");

  files:
    freebsd.snort::
      "/etc/rc.conf"
        handle          => "enable_snort_rcconf",
        comment         => "Enable snort in rc.conf",
        edit_line       => set_variable_values("snort.rc_conf"),
        edit_defaults   => no_backup,
        action          => immediate,
        classes         => if_ok("enabled_snort_rcconf");

    snort::
      "$(snort_rules_script)"
        create          => "true",
        edit_line       => snort_rules_update_script,
        edit_defaults   => no_backup,
        perms           => mog("500", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_rules_script");

      "$(snort_dir)/threshold.conf"
        copy_from       => remote_cp("$(sys.masterdir)/files/snort/threshold.conf", "$(sys.policy_hub)"),
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_snort_conf");

      "$(pulledpork_dir)/disablesid.conf"
        copy_from       => remote_cp("$(sys.masterdir)/files/pulledpork/disablesid.conf", "$(sys.policy_hub)"),
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_pulledpork_conf");
      
      "$(snort_dir)/snort.conf.staging"
        copy_from       => remote_cp("$(sys.masterdir)/files/snort/snort.conf", "$(sys.policy_hub)"),
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_snort_conf_staging");

      "$(pulledpork_dir)/pulledpork.conf.staging"
        copy_from       => remote_cp("$(sys.masterdir)/files/pulledpork/pulledpork.conf", "$(sys.policy_hub)"),
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_pulledpork_conf_staging");

      "$(snort_dir)/preproc_rules/sensitive-data.rules"
        copy_from       => local_cp("$(snort_dir)/preproc_rules/sensitive-data.rules-sample"),
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_snort_conf");

      "$(snort_dir)/rules/iplists/."
        create          => "true",
        perms           => mog("755", "root", "$(os.rootgroup)");
      
    updated_snort_conf_staging::
      "$(snort_dir)/snort.conf"
        create          => "true",
        edit_line       => expand_template("$(snort_dir)/snort.conf.staging"),
        edit_defaults   => no_backup,
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_snort_conf");

    updated_pulledpork_conf_staging::
      "$(pulledpork_dir)/pulledpork.conf"
        create          => "true",
        edit_line       => expand_template("$(pulledpork_dir)/pulledpork.conf.staging"),
        edit_defaults   => no_backup,
        perms           => mog("444", "root", "$(os.rootgroup)"),
        classes         => if_repaired("updated_pulledpork_conf");

  processes:
    snort.have_snort_package::
      "snort"
        restart_class   => "restart_snort";

  services:
    have_snort_package.enabled_snort_rcconf.(restart_snort|updated_snort_conf)::
      "snort" service_policy => "restart";
      
  commands:
    have_snort_package.updated_pulledpork_conf.!updated_rules_script::
      "$(pulledpork_reload) -THc $(pulledpork_dir)/pulledpork.conf";

    updated_rules_script::
      "$(snort_rules_script)";

  reports:
    enabled_snort_rcconf::
      "Enabled snort on $(rc_conf[snort_interface]) in /etc/rc.conf.";

    updated_snort_conf::
      "Updated snort config at $(snort_dir).";

    updated_pulledpork_conf::
      "Updated pulledpork config at $(pulledpork_dir).";

    restart_snort::
      "Restarted snort.";
}

bundle edit_line snort_rules_update_script {
  insert_lines:
      "#!/bin/sh$(const.n)/usr/local/bin/pulledpork.pl -THc /usr/local/etc/pulledpork/pulledpork.conf";
}

This will only install Snort if your host is defined in the classify-section AND has an interface defined to snort on.