Search and filter rules and suggestions

Sidebar

Little Snitch Configuration shows rules and rule suggestions matching certain filters. The sidebar contains the filters that determine which rules or rule suggestions are listed in the table.

Sidebar

There are four sections in the sidebar: Rules, Rule Groups, Profiles and Suggestions. Sections are hidden if they are empty. For instance you won’t see the Profiles section, until you create your first profile.

Rules — This section contains filters showing only rules, not suggestions. All entries except All Rules focus on rules with a particular property.
Rule Groups — This section shows all your rule groups and rule group subscriptions. You can enable or disable a group with a single click on the checkbox next to its name.
Profiles — The profiles section is slightly different from other filters: In addition to filtering the rules by the profiles in which they are effective, they can be used to assign rules to profiles (by dragging a rule on a profile) or edit the profile (by double-clicking a profile). The top bar in this section offers an option to show all rules that are effective in the profile (i.e. also show rules that are effective in all profiles) or just rules in this profile.
Suggestions — Rule suggestions can be filtered by the type of event that created the suggestion. When you select a filter in this section, a top bar is shown above the table that lets you easily create rules from suggestions or delete unnecessary rules as necessary.

For some sidebar filters, the rules and suggestions table is supplemented by a Top Bar. This top bar contains actions that are likely to be applied on rules or suggestions having the filtered property.

Topbar

Searching rules and suggestions

In addition to filtering on particular properties via the sidebar, you can search a rule’s or suggestion’s text. Enter a search term in the toolbar’s search field to focus only on rules and rule suggestions containing the search term. By default (search scope “All”), the term is searched using a substring match in:

the process name,
the full file system path of the process’ executable,
the bundle identifier of the process (for applications),
the textual representation of the rule’s properties as displayed in the rule list (this includes the server name or address),
the rule’s notes.

The search scope can be limited to any of these properties in the search field’s menu.

The search term is split into words (separated by spaces) and a rule matches if it contains all words in the selected search scope.

In the search scope “Process (exact match)”, the search term is not split into words. It is used as-is, including spaces and the entire process name must match the search term. In addition to rules for processes which match the term exactly, rules for Any Process match as well. The search scope therefore finds all rules which have an effect on network filtering for the given process.

Focus mode

Focus mode allows you to focus on just a specific subset of rules. To enter focus mode, select one or more rules and then choose View > Focus on Selected Rules or View > Focus on Rules Affecting Selection. This will focus on just the rules you want to see, while leaving the search field free for further filtering.

Focus Mode is also used for revealing matching rules from the connection alert or Network Monitor (e.g. by right-clicking a connection and choosing Show Corresponding Rules).