Glossary

Words the manual uses, alphabetically. Each entry links to the page that explains the thing properly.

Agent (background agent): the part of Outbound that runs in the background, separate from the window you open. It draws the menu bar item, answers the filter, runs the managed rule feed and audit export, and owns the global hotkey. See The menu bar item.

Alert: the question macOS shows when an app wants to connect and no rule decides. Answering it can remember the answer as a rule. See The connection alert.

Allow list: a subscription whose rules allow instead of block. Its entries wait in Review before they become rules. See Blocklists and rule groups.

App group container: the shared folder where rules.json, settings.json and the audit log live, so the app, the agent and outboundctl all see the same files. See Where Outbound keeps its data.

Blocklist: a list of hosts or domains you subscribe to by HTTPS URL; each entry becomes a block (or allow) rule. See Blocklists and rule groups.

Code identity: how Outbound names a program: its signing identifier, team and path, not just where the file sits today. See Code identity.

Connection: one network conversation an app starts: a destination, a port, a protocol and a direction. The Network Monitor lists them; rules decide them.

Filter (network filter): the system extension that actually sees and decides traffic. It keeps enforcing your rules even when the app is not running. See What is Outbound?.

Licence: the one-time purchase that activates Outbound. There is no trial. See Trial and licence.

Managed preferences: settings an organization forces through MDM in the domain com.outboundfirewall.outbound. A key only counts when it is forced. See Managed preferences.

Managed rule feed: an HTTPS document of rules an organization delivers to every managed Mac; its rules are replaced as a set on every fetch. See Managed rule feed.

Managed rules: rules that came from the feed. They show as the Organization source in the Rules pane and cannot be edited or deleted one by one.

Mode: Learn, Ask or Strict, the answer an unknown connection gets by default. See Operation modes.

Open Quickly: the palette (⇧⌘O) that jumps to any section, app, rule or action from a few typed letters. See Open Quickly.

Outboundctl: the command-line tool inside the app bundle, for rules, preferences, backups, the audit log and more. See outboundctl.

Pause: a timed break in enforcement, with choices from 15 minutes to until restart. The menu bar warns you while it runs. See Pausing and turning off the filter.

Priority rule: a rule that is compared before every other rule, so it can override a wider one. See Rules.

Profile: a named set of rules (Home, Office, Travel) that applies only while it is active, optionally switching by network. See Profiles.

Review: the queue of connections nobody answered and automatic decisions waiting for a look. See Review.

Rule: one decision about who may connect where: a program, a destination, ports, a protocol, an action and a lifetime. See Rules.

Rule group: a group of rules installed and updated as a whole, such as the “Trusted by default” groups or an accepted allow list. See Blocklists and rule groups.

Rule store: the rules.json file and its backup and lock files: everything the filter enforces. See The rules file format.

Signing identifier: the string inside a program’s code signature (like com.apple.Safari) that rules and the filter use to recognise it. See Code identity.

System extension: the macOS mechanism the network filter uses. It is approved once, and MDM can pre-approve it. See Deploying with MDM.

Telemetry: the reporting some apps send to their makers. Outbound can block known telemetry endpoints by category, and per app. See Trackers and telemetry.

Timeout: what happens to an unanswered alert: the connection gets the timeout action after the wait you set. See When you don’t answer.

Tracker: a server known to receive telemetry or advertising data. The tracker database names them in the monitor and the Tracking Report. See Trackers and telemetry.

Trusted by default: allow-rule groups Outbound can switch on so trusted software is not questioned. macOS services, iCloud and Apple services, Apple apps and VPN apps are on by default; “Apps you already have” and “Local network” are off until you turn them on. See Trusted apps.

Unapproved rule: a rule marked for review because it was created by an app, a script or someone else, so it does not go unnoticed. See Review.

Widget: the Outbound widgets that show whether this Mac is protected, what was blocked, the apps using the network most, and where connections went on a world map. See Widgets.