Rule groups

When you start using Little Snitch, you need to decide for every Internet connection whether you want to allow or deny it. That’s a lot of work, especially at the beginning and you may wish to copy a sensible set of rules from somebody you trust.

That’s exactly what rule groups are made for. Little Snitch ships with a few built-in rule groups. However, you can also subscribe to rule groups published and managed by somebody else.

Rule groups that ship with Little Snitch

Little Snitch currently ships with two built-in rule groups:

macOS Services: The rules in this group basically allow all connections to the domain apple.com for all processes. This includes usage statistics collected by Apple, location services, crash reports and so on. Enable this rule group if you trust Apple and don’t want to individually allow or deny these connections.
iCloud Services: The rules in this group allow all connections to iCloud for all processes. Enable this rule group if you want to use iCloud services built into macOS and third-party apps.

After the first installation, Little Snitch shows a Welcome Window asking you which of these rule groups you want to enable. You can re-play this Welcome Window by choosing Help > Welcome to Little Snitch in Little Snitch Configuration.

You can enable or disable rule groups at any time. Open Little Snitch Configuration and have a look at the Rule Groups section in the left sidebar.

Rule group subscriptions

In addition to the built-in groups you can subscribe to third-party rule groups that are published and maintained by somebody else.

The rules in these groups are global by design, so any changes you make to them (subscribe, unsubscribe, activate, deactivate, etc.) will affect all users on the computer and therefore require the Allow Global Rule Editing option to be turned on in Preferences > Security. Otherwise you will have to enter an administrator password whenever you make changes to a rule group subscription. Read the chapter Anatomy of a rule, section Process owner for more information.