Rule button

Each row of the connection list in Network Monitor has a rule button. It tells you at a glance whether rules cover the connections of the row, and it lets you create a rule with a single click.

Keep in mind that a row doesn’t stand for one connection, but for a group of connections: all connections that match the row. An app row, for example, stands for all connections of the app.

When you click the allow symbol or the deny symbol of the button, Little Snitch creates a rule that covers exactly the connections of the row, no more and no less. This is the associated rule of the row, and the button shows it in color: green for allow, red for deny.

Which rule is associated with which row depends on how you group the list. In the default grouping, a rule that allows all connections of an app is the associated rule of the app row. In the inverse grouping, which shows domains first, the same rule isn’t associated with any row.

Other rules may also apply to a row without covering exactly its connections: they cover more, or only some of them. The button shows these rules with a gray symbol.

The button tells you that rules exist, but not which ones. To see them, select the row and open the Rules section of the Inspector, where you can also edit, disable, or delete them.

The button can be in one of the following states:

STATE	DESCRIPTION
	No rule covers the connections of the row. The button appears only when you move the pointer over it. For new connections of this group, Little Snitch shows a connection alert. In Silent Mode, they become unconfirmed instead: they occurred in Silent Mode, but no rule covers them (blue button, see below).
	The row has an associated allow-rule, which covers exactly the connections of the row.
	The row has an associated deny-rule, which covers exactly the connections of the row.
	An allow-rule covers connections of the row, but it covers more connections than the row, or only some of them. If it’s the associated rule of a different row, you find that row on a higher or lower level.
	A deny-rule covers connections of the row, as above.
	The row has an associated allow-rule, but a deny-rule also covers some or all of its connections and has precedence over the allow-rule. If the deny-rule is the associated rule of a different row, you find that row on a lower level.
	As above, but with deny and allow exchanged.
	An allow-rule covers some connections of the row, and a deny-rule covers others. Neither covers exactly the connections of the row.
	Some or all connections of the row occurred in Silent Mode, and no rule covers them yet. Network Monitor calls them unconfirmed. In Alert Mode, Little Snitch would show a connection alert for them. Click the disclosure triangles to see more about these connections, then decide on which level to create a rule.
	A connection alert, possibly minimized, is open for one or more connections of the row. The connection is stalled: it waits until you create a rule. You can create the rule in the alert, or right here with the rule button. For a more specific rule, click the disclosure triangles to see more details first.
	A deny-rule with extra-high priority denies all connections of the process, because the process identity check failed. Click the button to delete the rule and accept the modification of the process.

You can also create, delete, or show the rules for a row with its context menu.

© 2016-2026 by Objective Development Software GmbH