The main window

One window holds a sidebar, the selected pane, and an inspector on the right. The full window’s minimum is 640 × 600 points, so it fits half of a 13-inch screen. The sidebar is at least 230 wide, the pane at least 600, and the inspector 310. When the window is narrower than the sidebar and the pane together (830), the sidebar steps aside, and it comes back at 850. When there is no room beside the pane, the inspector narrows to 250 and floats over the pane’s trailing edge. Compact mode’s minimum is 380 × 460. The full window remembers a width, starting from 1240. Whether the window is compact is remembered too, and it starts full.

The sidebar

The first section, with no heading, is Overview, Tracking Report, Network Monitor, Analytics, Highlights, Assistant. The Network Monitor row shows a red badge with the number of blocked connections in the current monitor, when that number is above zero.

• Decisions: Review, with a count when items are waiting.
• Rules: All Rules, Allowed, Blocked and Temporary are always listed. Recently Added, Recently Modified, Recently Used, Unapproved, Disabled and Organization appear only when they have rules. Recently Added, Recently Modified and Recently Used share a window of 7 days. Each row opens the rule manager for that view.
• Rule Groups: a checkbox and a name for each trusted group. The names you see are macOS services, iCloud & Apple, Apple apps, Apps you already have, Local network and VPN apps. The help for iCloud & Apple uses the full name iCloud & Apple services. The checkbox turns the group on or off. Turning one on can allow connections, so it asks for approval the way any other unblock does. The help reads “Turn TITLE on” or “Turn TITLE off”, and “Show the rules and settings of TITLE”. Click the name to open that group in the rule manager. On by default: macOS services, iCloud & Apple services, Apple apps and VPN apps. Local network and Apps you already have start off. While Apps you already have is being read, the row shows “Reading the apps in Applications…”. A count appears when the group is on and has rules. The checkbox is disabled when you may not edit rules.
• Lists: Blocklists (with a count), Trackers (no count), Profiles (with a count).

Settings sits at the bottom of the sidebar. It opens the Settings window, as ⌘, does.

Right-click a row for Open TITLE. On Network Monitor the menu also has Show Blocked Only, Show Everything and Open Mini Monitor. On a rules view it has Open in Rule Manager.

The status pill

The pill leads the toolbar. Hide the sidebar and it moves to the trailing edge. In the compact window the pill shows the shield alone. The words stay in the tooltip.

When the filter is on, connected, and the full sentence is the protecting one, the pill shortens it to “Protected · Ask mode” (Learn or Strict the same way). The tooltip keeps “Protecting this Mac · Ask mode”. A mode that is not confirmed yet reads “Mode unknown”. A change waiting for approval adds “ · change held”. While a change is in progress the pill shows that instead, such as “Switching to Strict…”, then “Applied”, “Waiting for approval” or “Saved; waiting for filter”. A refusal shows its reason.

Pill text	What it means
Protected · Ask mode	Filtering, and the filter has acknowledged the rules. The tooltip still says Protecting this Mac
Waiting for the filter	Connected, and the filter has not acknowledged the rules yet
Saved, but not applied	The filter rejected the configuration
Unblock held	An unblock is waiting for your approval
Filter on · reconnecting	The filter is on and the app is not connected to it
Waiting for your approval	macOS is waiting for you to allow the network filter
Paused until restart	Paused until this Mac restarts
Paused until 3:40 PM	Paused until that time
Filter settings unreadable	Outbound could not read the filter settings
Filter not answering	The filter is not answering
Outbound is off	The network filter is off
Network filter not installed	The system extension is not installed

The shield matches the filter: empty, half filled, filled, or a shield with an exclamation mark. A count badge appears when something needs you. Its help is “TEXT. N things need your attention.” or, with nothing waiting, “TEXT. Click to change the mode.” Clicking opens a popover with the mode chooser, and the attention list when something is waiting. The popover is 600 points wide when that list is showing and 380 otherwise, and at most 520 points tall.

Choosing the mode

The popover is headed Mode, with Learn, Ask and Strict. If your organization manages the mode, the chooser is disabled and reads “Your organization manages the mode on this Mac.” Otherwise the line under it is the same sentence as the menu bar’s mode footer.

Leaving Learn asks “Keep what Learn recorded?” The explanation reads: “Keeping turns the connections Learn allowed into rules, so apps you already use don’t alert. Without keeping, each app alerts the first time it connects.” The buttons are Cancel, Use Ask Without Keeping, and Keep and Use Ask. See Operation modes.

The toolbar

• Compact Window / Full Window (⌥⌘K). In the full window the help is “Just the live list, in a small window (⌥⌘K)”. In the compact window it is “Show the sidebar, map and inspector again (⌥⌘K)”.
• Inspector (⌥⌘I), hidden while compact. The help is “Hide the inspector (⌥⌘I)” or “Show the inspector (⌥⌘I)”.

The Firewall menu

• Mode: Learn, Ask or Strict. Disabled when the organization manages it, or while a mode change is busy. Under the picker: “Ask · not confirmed” or “Ask · waiting for approval”, using whichever mode is stored.
• Resume Filtering (⇧⌥⌘P) while paused. Otherwise Pause for 15 Minutes (⇧⌥⌘P), Pause for 1 Hour, Pause Until the Network Changes (disabled with no current network) and Pause Until Restart. See Pausing and turning off the filter.
• Turn Off Network Filter…, help “Stops all filtering until you turn it on again. Use it if the network stops working.” When the filter is off, the same place holds Turn On Network Filter.
• Profile: No Profile and your profiles. The menu is disabled when you may not edit rules.

Then Review New Connections (⇧⌘R), Network Monitor (⌘0) and Mini Monitor.

Other menus

• File › New Rule… (⌘N) opens the rule editor.
• File › Open Quickly… (⇧⌘O). See Open Quickly.
• File › Export as PDF… (⇧⌘E) and File › Print… (⌘P) save or print the Analytics or Tracking Report page you are on. Elsewhere they are dimmed.
• The application menu has Check for Updates….
• View › Go lists the sidebar sections in order, with ⌃⌘1 to ⌃⌘9.
• View › Sort By, Group By (⌥⌘1 to ⌥⌘6) and Time Range (⌃⌥⌘1 to ⌃⌥⌘9) set the Network Monitor list. They are dimmed when the Network Monitor is not showing.
• View › Show Map (⌥⌘M) and View › Show Traffic Chart (⌥⌘C). Both start on.
• View › Show Connection Log (⌥⌘L) switches the Network Monitor to the Connection Log.
• View › Float Network Monitor on Top (⌥⌘F). See Float on Top.
• View also has one switch for each connection type the Network Monitor can leave out.
• The Connection menu acts on the rows selected in the Network Monitor: Allow, Deny, Inspect (⌘I), Show Rule, Show in Blocklist, Approve Rules for Selection, Reset Counters for Selection and a Copy submenu. With nothing selected it says “Select a connection first.”
• The Help menu adds Show the Basics, Outbound Features…, Something Not Working?… and Report a Problem….

Tip

⌘K in the Network Monitor is From Now, so Open Quickly is ⇧⌘O.