The .lsrules file format

An .lsrules file describes a rule group in JSON syntax. Remote rule groups use this format, and you can import such a file into a rule group, too. To get one, export it from the Little Snitch app, or write it yourself with a text editor or a script. This page describes the format.

A simple example

This file contains one rule, which allows LaunchBar to check for software updates:

{
  "name": "LaunchBar Software Update",
  "description": "This rule allows LaunchBar to check for updates.",
  "rules": [
    {
      "action": "allow",
      "process": "/Applications/LaunchBar.app/Contents/MacOS/LaunchBar",
      "remote-hosts": "sw-update.obdev.at"
    }
  ]
}

Blocklists

Older versions of Little Snitch couldn’t read the usual blocklist formats, so blocklists had to be written as remote rule groups. The .lsrules format still supports a short form for them. With the syntax above, you’d have to repeat "process": "any" and "action": "deny" for every domain, hostname, or IP address. With thousands of entries, the file would get unnecessarily large, and every user of the rule group would have to download it.

The short form is much more compact:

{
    "name": "Social Media Blocklist",
    "description": "Blocks access to popular social media sites.",
    "denied-remote-domains": ["facebook.com", "twitter.com", "youtube.com"]
}

Top-level keys

The top level of an .lsrules file is a JSON dictionary with the following keys:

For blocklists, you can use the following keys:

Rule keys

Each rule in the file is a JSON dictionary with the following keys.

Specify the process

To say which processes a rule matches, give the executable of the process with these keys:

• To match any process, use:
  • "process": "any"
• To match a specific process, use:
  • "process" (String): The full path of the executable. For an app, that’s the path of the executable inside the app, not of the app bundle, for example /Applications/Safari.app/Contents/MacOS/Safari.
  • "via" (String, optional): The path of a helper process. With this key, the rule matches only when the executable uses this helper process. For example, a rule matches “Terminal via ping” if "process" is the path of Terminal and "via" is the path of ping. A rule for Terminal without "via" matches the connections of “Terminal via ping” as well.

A rule can identify a process by its absolute path or by its Code ID. To give a Code ID, add the prefix identifier., which tells Little Snitch that the value is a Code ID and not a path. The format is identifier.DEV_TEAM_ID/IDENTIFIER. The Code ID of Little Snitch, for example, is MLZF7K7B5R/at.obdev.littlesnitch, so you write identifier.MLZF7K7B5R/at.obdev.littlesnitch.

Specify the remote endpoint

There are several ways to give the remote endpoint of a rule. Use exactly one of these keys:

• "remote-addresses": A String with one or more IP addresses or ranges of IP addresses.
• "remote-hosts": A String with a hostname, or an Array of Strings with hostnames.
• "remote-domains": A String with a domain name, or an Array of Strings with domain names.
• "remote": A String with exactly one of the following values.
  • "any"
  • "local-net"
  • "multicast"
  • "broadcast"
  • "bonjour"
  • "bpf" (Berkeley Packet Filter)

Other keys

© 2016-2026 by Objective Development Software GmbH