Alerts settings

The Alerts page sets the defaults every connection alert starts from: how long it waits for you, what a decision covers, what happens when nobody answers, and how the alert window behaves. The alert itself is described in The connection alert.

Example data.

How long an alert waits

Wait for an answer: a stepper from 15 to 120 seconds, in steps of 5. Default 60 seconds. The label shows the current value, “60 seconds”. This is the TCP wait. A UDP flow waits 8 seconds, fixed, which the line under the controls states.

That line: “An alert waits for your answer (TCP: the time above, UDP: 8 seconds). After that the filter itself allows the connection once and adds it to Review. Strict always blocks.” When “If I do not answer” is Block once, “allows” in that sentence is “blocks”. Until the filter has confirmed the timeout, the line adds “Outbound has not confirmed the filter’s timeout yet.” If the filter is still on the previous timeout, it adds “The filter is still using its previous timeout until this change is approved.”

Unanswered alerts are covered in When you don’t answer.

What a decision starts as

Alerts start with: how long a decision you make in an alert lasts. Once, a timed choice (For 1 Hour unless you change Default duration), Until the app quits, Until logout, Until restart, Forever. Default Forever. An alert with no host name and no address starts at Once, whatever this is set to. The choices are explained on Choosing what to allow.

Applying to: Only that server (default), Its whole domain, or Any connection. In the alert, a domain choice falls back to the server when the connection has no host name, or when the name came from a DNS resolver.

Default duration: shown only while Alerts start with is the timed choice. For 5 Minutes, 15 Minutes, 30 Minutes, 1 Hour (default), 1 Day or 1 Week. The alert’s Remember picker offers all of them whatever this is set to.

Default profile scope: Every profile (default), or Only while the active profile is active. This sets whether the alert’s Only while (Profile) is active box starts ticked.

Default port and protocol: This port and protocol (default), Any port, this protocol, or Any port and protocol. This sets where the alert’s Port row starts.

Your organization can set the duration, profile scope and port defaults through a configuration profile. A managed setting is shown but cannot be changed, with a note that says so.

When you do not answer

If I do not answer: Allow once (default) or Block once. Disabled in Strict mode, which always blocks.

Without the background agent: Same as above (default), Allow, or Block. Disabled in Strict mode. The text under it: “Your rules still apply. For other connections, Learn allows and Strict blocks. Ask uses this choice, but blocks apps it cannot identify.” Same as above follows “If I do not answer”.

The alert window

The section in Settings is titled Alert Window.

Details: Compact (default) or Full. The text under it: “Full shows the program’s path, signature and server address immediately.” Compact starts with those hidden. The info button on the alert, or ⌘I, shows them. See Connection details.

Answer with Return and Escape: on by default. “Return chooses the highlighted answer; Escape blocks.”

Give alerts keyboard focus: off by default. “Return, Escape and ⌘1–4 answer the active alert.” When on, Outbound activates and makes the alert the key window 950 milliseconds after it appears, if it is still on screen and not minimized, so those keys answer it without a click first. A Return typed into another app as the alert appears is not treated as an answer.

Keep connection alerts minimized: off by default. “New alerts open as the small countdown panel. Click it to answer.” The countdown keeps running while an alert is minimized; see Several alerts at once.

Reset “Don’t Warn Again”: clears every remembered don’t-warn-again choice for block warnings. While it runs the button reads “Resetting…”. Afterwards it reports “Block warnings reset.”

The keyboard’s full set is on Alert keyboard shortcuts. When several alerts queue up at once, see Several alerts at once.