Search and filter

Use the search field to narrow down the list of rules or suggestions to those matching certain criteria.

Search Field

Search term — Show only rules containing the string entered here.
Scope — Choose the scope where to search for the search term. Whether to search in the process name only, in the notes etc.
Incoming — Click here to show only rules for incoming connections.
Denied — Click here to show only Deny-rules.
Unconfirmed — Click here to show only new rules which have not been confirmed.
Filter menu — A menu with a lot more filter options. Filter rules by action, by owner, by process type by destination type or limit display to factory rules or blocklists only.

While the search field is also available in the Networks view, filter buttons and filter menu are specific to rules and are therefore not available.

Search Term

The search term is split into words (separated by spaces) and a rule matches if it contains all words in the selected search scope.

In the search scope Process (exact match), the search term is not split into words. It is used as-is, including spaces and the entire process name must match the search term. In addition to rules for processes which match the term exactly, rules for Any Process match as well. The search scope therefore finds all rules which have an effect on network filtering for the given process.

Sidebar

The sidebar can be seen as an additional filter which limits the set of rules searched with the search field. A rule group, for instance, pre-filters the rule set to show only rules which have the Group property set to the particular group.

Sidebar

The sidebar is more than just a filter, though: You can drag rules to groups or profiles in order to add them to the group or profile. The Blocklists section does not only filter to the particular blocklist rules, it expands those rules to their individual entries and shows them in the form of rules.

Focus mode

While the filters mentioned so far select the rules shown by their properties, focus mode gets an explicit list of rules to search and filter:

Select a couple of rules, right-click the selection and choose Focus on Selected Rules to enter focus mode with the selected rules.
Select at least one rule for a process, right-click the selection and choose Focus on Rules Affecting… to enter focus mode with all rules which can possibly match the process. This is particularly useful in combination with sorting by precedence to analyze connectivity problems.
Right click a line in Network Monitor and choose Show Corresponding Rules to focus on all rules affecting the line. Use this to find out what causes gray sections in the rule management button.
Right click a line in Network Monitor and choose Show Recently Used Rules (only available if connections were made within the last 10 minutes) to focus on all rules which allowed or denied connections grouped in this line. Use this to find the cause of connectivity problems, e.g. when you see the line flashing in red to indicate a blocked connection, but you wonder why.