{
  "schemaVersion": 1,
  "rules": [
    {
      "id": "8E2A6B40-3C1D-4F57-9A0E-5B7C1D2E3F41",
      "action": "deny",
      "direction": "outgoing",
      "process": { "any": {} },
      "remote": { "domain": { "_0": "telemetry.example.net" } },
      "ports": { "any": {} },
      "proto": "any",
      "lifetime": { "forever": {} },
      "priority": false,
      "enabled": true,
      "source": { "managed": {} },
      "createdAt": "2026-10-01T09:00:00Z",
      "note": "Block vendor telemetry"
    },
    {
      "id": "8E2A6B40-3C1D-4F57-9A0E-5B7C1D2E3F42",
      "action": "allow",
      "direction": "outgoing",
      "process": { "codeIdentity": { "teamID": "ABCDE12345", "signingID": "com.example.vpn" } },
      "remote": { "host": { "_0": "vpn.corp.example.com" } },
      "ports": { "ports": { "_0": [[443, 443]] } },
      "proto": "tcp",
      "lifetime": { "forever": {} },
      "priority": true,
      "enabled": true,
      "source": { "managed": {} },
      "createdAt": "2026-10-01T09:00:00Z",
      "note": "Corporate VPN client"
    },
    {
      "id": "8E2A6B40-3C1D-4F57-9A0E-5B7C1D2E3F43",
      "action": "deny",
      "direction": "outgoing",
      "process": { "any": {} },
      "remote": { "address": { "_0": "203.0.113.7" } },
      "ports": { "any": {} },
      "proto": "any",
      "lifetime": { "until": { "_0": "2027-01-01T00:00:00Z" } },
      "priority": false,
      "enabled": true,
      "source": { "managed": {} },
      "createdAt": "2026-10-01T09:00:00Z",
      "note": "Incident 4711: known-bad address, review at year end"
    }
  ]
}