Firewall rules: the built-in rules and what Off, Record only and Enforce do

ToolPiper has four built-in firewall rules that look at what an agent's session has already done and stop a later call that is risky because of it, such as running a command after reading a web page. Each rule is set to Off, Record only or Enforce. The rules follow your Security level until you change one: off at Disabled and Default, record only at Balanced, and enforce at Strict. Open Security in ToolPiper and choose the Firewall rules tab to see and change them.

The four built-in rules

• After a session reads content from outside this Mac, such as a web page, the rule stops its tools that run commands or change files.
• After a session reads outside content and then your private data, the rule stops its tools that send or save anything outside ToolPiper.
• After a session has sent or saved something outside ToolPiper more times than its per-session limit, the rule stops it from doing so again.
• When ToolPiper cannot follow a caller's session, the rule stops its tools that send or save outside ToolPiper, run commands or change files.

Off, Record only and Enforce

• Off: the rule does nothing.
• Record only: a call the rule matches still runs, and the match is recorded, so you can see what the rule would have stopped before you enforce it.
• Enforce: a call the rule matches is refused.

Changing a rule

Each rule has its own three-way switch and a line saying whether it follows the level or you changed it. Choosing the state the level already sets makes the rule follow the level again.

Setting a rule to do less, toward Off or Record only, asks for your password or Touch ID. Setting it toward Enforce asks for nothing. The row says so before you click.

During a pause

While a pause is on, a rule the level sets to Enforce only records until the pause ends. A rule you switched to Enforce yourself still enforces, because it is your own choice.

Rules you wrote

Below the built-in rules, the tab lists the rules you wrote. A rule you wrote can refuse a call or ask before it, and it applies at every Security level. One that asks is answered with a click, and with your password or Touch ID at Strict. A rule you wrote with the same id as a built-in rule replaces that built-in rule, and its row says so.

Replay against the trail runs every rule on the tab against your recent calls and shows what each would have matched. It changes nothing. A rule that is still being tried out has Promote to enforcing when you are ready for it to take effect.

Resetting to the level

On the Security Overview, Reset beside Firewall rules clears every switch you changed so all four rules follow the level again. It shows the exact list first and writes nothing until you confirm. Clearing a switch so that a rule does less asks for your password or Touch ID.