{ "name": "Apple Ecocide", "description": "Generated by apple-ecocide v0.1.0. Mode: allow. Severity: aggressive. Allowed (2): apple-appstore, apple-software-updates. Denied (41): apple-ads, apple-books, apple-captive-portal, apple-content, apple-device-setup, apple-dns, apple-find-my, apple-game-center, apple-homekit, apple-icloud, apple-intelligence, apple-location, apple-maps, apple-mdm, apple-messaging, apple-music, apple-news, apple-pay, apple-podcasts, apple-push-notifications, apple-screentime, apple-siri, apple-stocks, apple-telemetry, apple-time-servers, apple-tv, apple-universal-links, apple-wallpapers, apple-weather, brave-safe-browsing, brave-telemetry, chrome-telemetry, google-ads, google-safe-browsing, google-telemetry, microsoft-telemetry, mozilla-safe-browsing, mozilla-telemetry, ocsp, opera-telemetry, safari-telemetry", "rules": [ { "action": "deny", "priority": "high", "process": "/usr/libexec/adprivacyd", "remote": "any", "protocol": "any", "notes": "[apple-ads] Block Ad Privacy daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Books.app/Contents/MacOS/Books", "remote": "any", "protocol": "any", "notes": "[apple-books] Block Books app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/BookKit.framework/Versions/A/XPCServices/com.apple.BKAgentService.xpc/Contents/MacOS/com.apple.BKAgentService", "remote": "any", "protocol": "any", "notes": "[apple-books] Block Books agent from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/captiveagent", "remote": "any", "protocol": "any", "notes": "[apple-captive-portal] Block Captive Network Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd", "remote": "any", "protocol": "any", "notes": "[apple-content] Block Help Viewer daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/FindMy.app/Contents/MacOS/FindMy", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Find My app from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/findmylocateagent", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Find My location daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/FindMyMac.framework/Resources/FindMyMacd", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Find My Mac daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/findmydeviced", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Find My Device daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/findmybeaconingd", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Find My beaconing daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/searchpartyd", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Search Party daemon (Find My network) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/searchpartyuseragent", "remote": "any", "protocol": "any", "notes": "[apple-find-my] Block Search Party user agent from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/gamed", "remote": "any", "protocol": "any", "notes": "[apple-game-center] Block Game Center daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/GameCenterUICore.framework/XPCServices/com.apple.gamecenter.GameCenterUIService.xpc/Contents/MacOS/com.apple.gamecenter.GameCenterUIService", "remote": "any", "protocol": "any", "notes": "[apple-game-center] Block Game Center UI agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Home.app/Contents/MacOS/Home", "remote": "any", "protocol": "any", "notes": "[apple-homekit] Block Home app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed", "remote": "any", "protocol": "any", "notes": "[apple-homekit] Block HomeKit daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/iOSSupport/System/Library/PrivateFrameworks/HomeEnergyDaemon.framework/Support/homeenergyd", "remote": "any", "protocol": "any", "notes": "[apple-homekit] Block Home Energy daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block iCloud sync daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/iCloudDriveCore.framework/Versions/A/Support/bird", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block iCloud document sync (bird) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Notes.app/Contents/MacOS/Notes", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Notes app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Reminders.app/Contents/MacOS/Reminders", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Reminders app from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/remindd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Reminders daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/Contacts.framework/Support/contactsd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Contacts daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Call History sync from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block AuthKit daemon (Apple ID authentication) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/DataAccess.framework/Support/dataaccessd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Data Access daemon (Calendar/Contacts/Mail sync) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/iCloudNotification.framework/iCloudNotificationAgent", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block iCloud Notification Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/EmailDaemon.framework/Versions/A/maild", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Mail daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/icloudmailagent", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block iCloud Mail agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CalendarDaemon.framework/Support/calaccessd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Calendar access daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/rapportd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Rapport daemon (Handoff/Continuity) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/sharingd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Sharing daemon (AirDrop) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/nearbyd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Nearby daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Synced Defaults daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ReplicatorCore.framework/Support/replicatord", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Replicator daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ProtectedCloudStorage.framework/Helpers/ProtectedCloudKeySyncing", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Protected Cloud Key Syncing from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block CDP daemon (iCloud Device Pairing) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/appleaccountd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Apple Account daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Accounts daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CloudServices.framework/Helpers/com.apple.sbd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block iCloud sync daemon (sbd) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/DoNotDisturbServer.framework/Support/donotdisturbd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Do Not Disturb daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/FileProvider.framework/Support/fileproviderd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block File Provider daemon (iCloud Drive) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Media Analysis daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/PhotoAnalysis.framework/Versions/A/Support/photoanalysisd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Photo Analysis daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/PhotoLibraryServices.framework/Versions/A/Support/photolibraryd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block Photo Library daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/UserActivity.framework/Agents/useractivityd", "remote": "any", "protocol": "any", "notes": "[apple-icloud] Block User Activity daemon (Handoff) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/GenerativeExperiencesRuntime.framework/Versions/A/generativeexperiencesd", "remote": "any", "protocol": "any", "notes": "[apple-intelligence] Block Generative Experiences daemon (Apple Intelligence) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/IntelligencePlatformCompute.framework/Versions/A/XPCServices/IntelligencePlatformComputeService.xpc/Contents/MacOS/IntelligencePlatformComputeService", "remote": "any", "protocol": "any", "notes": "[apple-intelligence] Block Intelligence Platform Compute service from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod", "remote": "any", "protocol": "any", "notes": "[apple-location] Block location services daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/GeoAnalytics.framework/geoanalyticsd", "remote": "any", "protocol": "any", "notes": "[apple-location] Block Geo Analytics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/routined", "remote": "any", "protocol": "any", "notes": "[apple-location] Block Routine daemon (location patterns) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/locationd", "remote": "any", "protocol": "any", "notes": "[apple-location] Block Location daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/GeoServices.framework/geodMachServiceBridge", "remote": "any", "protocol": "any", "notes": "[apple-location] Block Geo Services Mach bridge from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent", "remote": "any", "protocol": "any", "notes": "[apple-location] Block Core Location Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Maps.app/Contents/MacOS/Maps", "remote": "any", "protocol": "any", "notes": "[apple-maps] Block Maps app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/mapspushd", "remote": "any", "protocol": "any", "notes": "[apple-maps] Block Maps push daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/studentd", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Classroom/education daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/RemoteManagement.framework/remotemanagementd", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Remote Management daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/mobileactivationd", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Mobile Activation daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/RemoteManagement.framework/XPCServices/InteractiveLegacyProfilesSubscriber.xpc/Contents/MacOS/InteractiveLegacyProfilesSubscriber", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Interactive Legacy Profiles Subscriber from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/RemoteManagement.framework/XPCServices/LegacyProfilesSubscriber.xpc/Contents/MacOS/LegacyProfilesSubscriber", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Legacy Profiles Subscriber from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/RemoteManagement.framework/XPCServices/ManagedConfigurationFilesSubscriber.xpc/Contents/MacOS/ManagedConfigurationFilesSubscriber", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Managed Configuration Files Subscriber from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/ManagedSettings.framework/Versions/A/ManagedSettingsAgent", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Managed Settings Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/betaenrollmentd", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Beta Enrollment daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/betaenrollmentagent", "remote": "any", "protocol": "any", "notes": "[apple-mdm] Block Beta Enrollment agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Messages.app/Contents/MacOS/Messages", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block Messages app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/IMCore.framework/imagent.app/Contents/MacOS/imagent", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block iMessage agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/Contents/MacOS/identityservicesd", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block Identity Services daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block Call Services daemon (FaceTime) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/avconferenced", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block AV Conferencing daemon (FaceTime) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/TelephonyUtilities.framework/XPCServices/com.apple.FaceTime.FTConversationService.xpc/Contents/MacOS/com.apple.FaceTime.FTConversationService", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block FaceTime Conversation Service from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersistenceAgent.xpc/Contents/MacOS/IMDPersistenceAgent", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block iMessage Persistence Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/IMDPersistence.framework/IMAutomaticHistoryDeletionAgent.app/Contents/MacOS/IMAutomaticHistoryDeletionAgent", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block iMessage History Deletion Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/SocialLayer.framework/sociallayerd.app/Contents/MacOS/sociallayerd", "remote": "any", "protocol": "any", "notes": "[apple-messaging] Block Social Layer daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Music.app/Contents/MacOS/Music", "remote": "any", "protocol": "any", "notes": "[apple-music] Block Music app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/AMPDevices.framework/Versions/A/Support/AMPDeviceDiscoveryAgent", "remote": "any", "protocol": "any", "notes": "[apple-music] Block Music device discovery agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/iTunesCloud.framework/Support/itunescloudd", "remote": "any", "protocol": "any", "notes": "[apple-music] Block iTunes Cloud daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent", "remote": "any", "protocol": "any", "notes": "[apple-music] Block Media Remote agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted", "remote": "any", "protocol": "any", "notes": "[apple-music] Block Media Remote daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/News.app/Contents/MacOS/News", "remote": "any", "protocol": "any", "notes": "[apple-news] Block News app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/NewsDaemon.framework/newsd", "remote": "any", "protocol": "any", "notes": "[apple-news] Block News daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/PassKitCore.framework/passd", "remote": "any", "protocol": "any", "notes": "[apple-pay] Block Wallet/Passes daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/FinanceKit.framework/financed", "remote": "any", "protocol": "any", "notes": "[apple-pay] Block Finance daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Podcasts.app/Contents/MacOS/Podcasts", "remote": "any", "protocol": "any", "notes": "[apple-podcasts] Block Podcasts app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd", "remote": "any", "protocol": "any", "notes": "[apple-push-notifications] Block Apple Push Services daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nbagent.app/Contents/MacOS/nbagent", "remote": "any", "protocol": "any", "notes": "[apple-push-notifications] Block Notification Center agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/AskPermission.framework/Versions/A/Resources/askpermissiond", "remote": "any", "protocol": "any", "notes": "[apple-screentime] Block Screen Time permission request daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent", "remote": "any", "protocol": "any", "notes": "[apple-screentime] Block Screen Time agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/UsageTracking.framework/Versions/A/UsageTrackingAgent", "remote": "any", "protocol": "any", "notes": "[apple-screentime] Block Screen Time Usage Daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/FamilyCircle.framework/Versions/A/Resources/familycircled", "remote": "any", "protocol": "any", "notes": "[apple-screentime] Block Family Circle daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/ManagedSettings.framework/Versions/A/ManagedSettingsAgent", "remote": "any", "protocol": "any", "notes": "[apple-screentime] Block Managed Settings agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Siri.app/Contents/MacOS/Siri", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri assistant daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/siriknowledged", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri knowledge daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreParsec.framework/parsecd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block parsecd (Siri suggestions) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/knowledge-agent", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block knowledge agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreParsec.framework/parsec-fbf", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Parsec feedback daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Suggestions daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/SiriInference.framework/Versions/A/siriinferenced", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri inference daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/VoiceShortcuts.framework/Versions/A/Support/siriactionsd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri actions daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ContinuousDialogManagerService.framework/assistant_cdmd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Siri dialog manager from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Core Speech daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd_system", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block System Core Speech daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Contacts Donation Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/naturallanguaged", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Natural Language daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Spotlight app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/Frameworks/CoreSpotlight.framework/spotlightknowledged", "remote": "any", "protocol": "any", "notes": "[apple-siri] Block Spotlight Knowledge daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Stocks.app/Contents/MacOS/Stocks", "remote": "any", "protocol": "any", "notes": "[apple-stocks] Block Stocks app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Stocks.app/Contents/PlugIns/StocksWidget.appex/Contents/MacOS/StocksWidget", "remote": "any", "protocol": "any", "notes": "[apple-stocks] Block Stocks widget from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/tipsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Tips daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/promotedcontentd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block promotedcontentd from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/AppleMediaServicesUI.framework/amsengagementd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block App Store engagement daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/rtcreportingd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block RTC (FaceTime) reporting daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CloudTelemetry.framework/Versions/A/XPCServices/CloudTelemetryService.xpc/Contents/MacOS/CloudTelemetryService", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block iCloud Telemetry service from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Core Analytics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/osanalyticshelper", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block OS Analytics helper from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/diagnostics_agent", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Diagnostics agent from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/diagnosticspushd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Diagnostics push daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/diagnosticextensionsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Diagnostics extensions daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Support/awdd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Wireless Diagnostics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/wifianalyticsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block WiFi Analytics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/wifivelocityd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block WiFi Velocity daemon (speed tests/diagnostics) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/metrickitd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block MetricKit daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/symptomsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Symptoms daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/symptomsd-diag", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Symptoms diagnostics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/swtransparencyd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Software Transparency daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/ReportCrash", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Crash Reporter from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/CoreServices/CrashReporterSupportHelper", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Crash Reporter Support Helper from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/feedbackd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Feedback daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/inputanalyticsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Input Analytics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/audioanalyticsd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Audio Analytics daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/triald", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Trial daemon (A/B testing) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/triald_system", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block System Trial daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/NewDeviceOutreach.framework/ndoagent", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block New Device Outreach agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreADI.framework/adid", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Apple Device ID daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/Synapse.framework/Support/contentlinkingd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Content Linking daemon (Synapse) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/ContextStoreAgent", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Context Store Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/contextstored", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Context Store daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/coreduetd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Core Duet daemon (usage prediction) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/duetexpertd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Duet Expert daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/eligibilityd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Eligibility daemon (feature/region checks) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/CoreFollowUp.framework/Versions/A/Support/followupd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Follow-up daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/intelligentroutingd", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Intelligent Routing daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/ospredictiond", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block OS Prediction daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/PowerLog.framework/Versions/A/XPCServices/PerfPowerTelemetryClientRegistrationService.xpc/Contents/MacOS/PerfPowerTelemetryClientRegistrationService", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Performance/Power Telemetry service from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/StatusKit.framework/StatusKitAgent", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block Status Kit Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/WiFiPolicy.framework/XPCServices/WiFiCloudAssetsXPCService.xpc/Contents/MacOS/WiFiCloudAssetsXPCService", "remote": "any", "protocol": "any", "notes": "[apple-telemetry] Block WiFi Cloud Assets service from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/TV.app/Contents/MacOS/TV", "remote": "any", "protocol": "any", "notes": "[apple-tv] Block TV app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/TVIdleServices.framework/idleassetsd", "remote": "any", "protocol": "any", "notes": "[apple-tv] Block TV idle assets daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Applications/Weather.app/Contents/MacOS/Weather", "remote": "any", "protocol": "any", "notes": "[apple-weather] Block Weather app from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/WeatherDaemon.framework/weatherd", "remote": "any", "protocol": "any", "notes": "[apple-weather] Block Weather daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/sbin/ocspd", "remote": "any", "protocol": "any", "notes": "[ocsp] Block OCSP daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/syspolicyd", "remote": "any", "protocol": "any", "notes": "[ocsp] Block System Policy daemon (Gatekeeper/notarization) from all network access" }, { "action": "deny", "priority": "high", "process": "/usr/libexec/transparencyd", "remote": "any", "protocol": "any", "notes": "[ocsp] Block Certificate Transparency daemon from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Cryptexes/App/usr/libexec/PasswordBreachAgent", "remote": "any", "protocol": "any", "notes": "[safari-telemetry] Block Password Breach Agent (compromised password checking) from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Cryptexes/App/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariBookmarksSyncAgent", "remote": "any", "protocol": "any", "notes": "[safari-telemetry] Block Safari Bookmarks Sync Agent from all network access" }, { "action": "deny", "priority": "high", "process": "/System/Library/PrivateFrameworks/WebPrivacy.framework/Versions/A/webprivacyd", "remote": "any", "protocol": "any", "notes": "[safari-telemetry] Block Web Privacy daemon (Safari web push/privacy) from all network access" }, { "action": "deny", "process": "any", "remote-domains": [ "iadsdk.apple.com", "iadsdk.apple.com.edgekey.net", "cf.iadsdk.apple.com", "tr.iadsdk.apple.com", "ut.iadsdk.apple.com", "news.iadsdk.apple.com", "news.iadsdk.v.aaplimg.com", "news.iadsdk.apple.com.akadns.net", "news.iadsdk-lb.apple.com.akadns.net" ], "notes": "[apple-ads] Apple advertising SDK and tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "books.apple.com", "api.books.apple.com", "book.itunes.apple.com" ], "notes": "[apple-books] Apple Books store" }, { "action": "deny", "process": "any", "remote-domains": [ "bookkeeper.itunes.apple.com", "books-storage.itunes.apple.com" ], "notes": "[apple-books] Apple Books content delivery" }, { "action": "deny", "process": "any", "remote-domains": [ "audiobooks.apple.com", "audiobooks.itunes.apple.com" ], "notes": "[apple-books] Apple Audiobooks" }, { "action": "deny", "process": "any", "remote-domains": [ "captive.apple.com", "captive-cdn.origin-apple.com.akadns.net", "captive-cidr.origin-apple.com.akadns.net", "captive-geo.origin-apple.com.akadns.net", "captive.g.aaplimg.com" ], "notes": "[apple-captive-portal] Captive portal detection servers" }, { "action": "deny", "process": "any", "remote-domains": [ "audiocontentdownload.apple.com" ], "notes": "[apple-content] GarageBand and audio content" }, { "action": "deny", "process": "any", "remote-domains": [ "playgrounds-assets-cdn.apple.com", "playgrounds-cdn.apple.com" ], "notes": "[apple-content] Swift Playgrounds content" }, { "action": "deny", "process": "any", "remote-domains": [ "fonts.apple.com" ], "notes": "[apple-content] Apple fonts and typography" }, { "action": "deny", "process": "any", "remote-domains": [ "cds.apple.com" ], "notes": "[apple-content] Help Viewer content (helpd)" }, { "action": "deny", "process": "any", "remote-domains": [ "albert.apple.com", "albert.gcsis-apple.com.akadns.net" ], "notes": "[apple-device-setup] Apple activation/provisioning" }, { "action": "deny", "process": "any", "remote-domains": [ "gs.apple.com", "gs.apple.com.akadns.net", "gsas.apple.com", "gsas.apple.com.akadns.net", "gsa.apple.com", "gsa.apple.com.akadns.net", "gs-loc.apple.com", "gsra.apple.com", "humb.apple.com", "sq-device.apple.com" ], "notes": "[apple-device-setup] Apple device activation and setup" }, { "action": "deny", "process": "any", "remote-domains": [ "configuration.apple.com", "configuration.apple.com.akadns.net", "configuration.apple.com.edgekey.net", "configuration.v.aaplimg.com", "configuration-row-lb.apple.com.akadns.net", "device-config.pcms.apple.com", "device-config.v.aaplimg.com" ], "notes": "[apple-device-setup] Apple remote configuration" }, { "action": "deny", "process": "any", "remote-domains": [ "lcdn-registration.apple.com", "serverstatus.apple.com", "lcdn-locator.apple.com", "lcdn-locator-usuqo.apple.com.akadns.net" ], "notes": "[apple-device-setup] Content caching and CDN locator" }, { "action": "deny", "process": "any", "remote-domains": [ "itunes.com", "appldnld.apple.com.edgesuite.net" ], "notes": "[apple-device-setup] Carrier updates" }, { "action": "deny", "process": "any", "remote-domains": [ "doh.dns.apple.com" ], "notes": "[apple-dns] Apple DNS over HTTPS" }, { "action": "deny", "process": "any", "remote-domains": [ "fmf.apple.com", "fmfmobile.icloud.com", "fmip.apple.com", "fmipmobile.icloud.com" ], "notes": "[apple-find-my] Find My Friends and Find My iPhone" }, { "action": "deny", "process": "any", "remote-domains": [ "gc.apple.com", "gamecenterd.apple.com", "service.gc.apple.com" ], "notes": "[apple-game-center] Game Center services" }, { "action": "deny", "process": "any", "remote-domains": [ "home.apple.com", "homekit.apple.com", "hap.apple.com", "hkgateway.apple.com", "homeaccessory.apple.com" ], "notes": "[apple-homekit] Apple Home and HomeKit services" }, { "action": "deny", "process": "any", "remote-domains": [ "hkregister.apple.com", "hksetup.apple.com", "hme.apple.com", "household.apple.com" ], "notes": "[apple-homekit] HomeKit registration and setup" }, { "action": "deny", "process": "any", "remote-domains": [ "icloud.com", "www.icloud.com", "icloud.apple.com", "icloud-content.com" ], "notes": "[apple-icloud] iCloud main services" }, { "action": "deny", "process": "any", "remote-domains": [ "setup.icloud.com", "setup.apple.com", "idmsa.apple.com", "appleid.apple.com", "appleid.cdn-apple.com", "iforgot.apple.com", "gsa.apple.com", "gsas.apple.com" ], "notes": "[apple-icloud] iCloud/Apple ID authentication" }, { "action": "deny", "process": "any", "remote-domains": [ "keyvalueservice.icloud.com", "kvstore.icloud.com", "ckdatabase.icloud.com", "ckdevice.icloud.com", "ckconfiguration.icloud.com" ], "notes": "[apple-icloud] iCloud CloudKit database services" }, { "action": "deny", "process": "any", "remote-domains": [ "gateway.icloud.com", "webcourier.push.apple.com", "quota.icloud.com" ], "notes": "[apple-icloud] iCloud gateway and quota services" }, { "action": "deny", "process": "any", "remote-domains": [ "mail.me.com", "smtp.mail.me.com", "imap.mail.me.com", "caldav.icloud.com", "carddav.icloud.com", "contacts.icloud.com", "calendar.icloud.com" ], "notes": "[apple-icloud] iCloud Mail, Calendar, Contacts sync" }, { "action": "deny", "process": "any", "remote-domains": [ "photos.icloud.com", "sharedstreams.icloud.com" ], "notes": "[apple-icloud] iCloud Photos" }, { "action": "deny", "process": "any", "remote-domains": [ "metrics.icloud.com", "xp.icloud-content.com", "feedbackws.icloud.com" ], "notes": "[apple-icloud] iCloud metrics and feedback" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-relay.cloudflare.com", "apple-relay.fastly-edge.com", "apple-relay.apple.com", "cp4.cloudflare.com", "mask.icloud.com", "mask-h2.icloud.com", "mask-api.icloud.com", "gateway-oblivious.apple.com" ], "notes": "[apple-icloud] iCloud Private Relay and Oblivious HTTP" }, { "action": "deny", "process": "any", "remote-domains": [ "www.icloud.com.cn", "icloud.com.cn", "apzones.com" ], "notes": "[apple-icloud] iCloud China endpoints" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-cloudkit.com", "api.apple-cloudkit.com" ], "notes": "[apple-icloud] CloudKit platform services" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-livephotoskit.com" ], "notes": "[apple-icloud] iCloud Live Photos" }, { "action": "deny", "process": "any", "remote-domains": [ "iwork.apple.com" ], "notes": "[apple-icloud] iWork document services" }, { "action": "deny", "process": "any", "remote-domains": [ "account.apple.com" ], "notes": "[apple-icloud] Apple Account management" }, { "action": "deny", "process": "any", "remote-domains": [ "statici.icloud.com" ], "notes": "[apple-icloud] iCloud static resources" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-pcc.com", "pcc.apple.com", "private-cloud-compute.apple.com", "privatecloud.apple.com", "privatecomputecloud.apple.com" ], "notes": "[apple-intelligence] Apple Intelligence Private Cloud Compute (PCC)" }, { "action": "deny", "process": "any", "remote-domains": [ "ml.apple.com", "machinelearning.apple.com", "coreml.apple.com", "ai.apple.com", "intelligence.apple.com", "apple-intelligence.apple.com" ], "notes": "[apple-intelligence] Apple Machine Learning and AI services" }, { "action": "deny", "process": "any", "remote-domains": [ "knowledge.apple.com", "proactive.apple.com", "parsec.apple.com" ], "notes": "[apple-intelligence] Apple Knowledge and Proactive Intelligence" }, { "action": "deny", "process": "any", "remote-domains": [ "gspe1-ssl.ls.apple.com", "gspe19-ssl.ls.apple.com", "gspe21-ssl.ls.apple.com", "gspe35-ssl.ls.apple.com", "gsp-ssl.ls.apple.com", "gsp1.apple.com", "gsp9-ssl.apple.com", "gsp10-ssl.apple.com", "gspe21-ssl.ls-apple.com.akadns.net", "gspe35-ssl.ls-apple.com.akadns.net", "gspe21-applecdn-cutover.ls-apple.com.akadns.net", "gspe35-applecdn-cutover.ls-apple.com.akadns.net", "gspe21-cdn.v.aaplimg.com", "gspe35-cdn.v.aaplimg.com" ], "notes": "[apple-location] Apple Location Services (geod) - Wi-Fi/cell positioning" }, { "action": "deny", "process": "any", "remote-domains": [ "ls.apple.com", "configuration.ls.apple.com", "configuration.ls.v.aaplimg.com", "configuration-lb.ls-apple.com.akadns.net" ], "notes": "[apple-location] Location services configuration" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-mapkit.com" ], "notes": "[apple-maps] Apple Maps tile and data servers" }, { "action": "deny", "process": "any", "remote-domains": [ "world-gen.g.aaplimg.com" ], "notes": "[apple-maps] Apple Maps telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "mdmenrollment.apple.com", "deviceenrollment.apple.com", "iprofiles.apple.com" ], "notes": "[apple-mdm] MDM enrollment and management" }, { "action": "deny", "process": "any", "remote-domains": [ "axm-adm-enroll.apple.com", "axm-adm-mdm.apple.com", "axm-adm-scep.apple.com" ], "notes": "[apple-mdm] Device Enrollment Program (DEP)" }, { "action": "deny", "process": "any", "remote-domains": [ "business.apple.com", "school.apple.com", "api.ent.apple.com", "api.edu.apple.com", "api-business.apple.com", "api-school.apple.com" ], "notes": "[apple-mdm] Apple Business/School Manager" }, { "action": "deny", "process": "any", "remote-domains": [ "axm-app.apple.com", "axm-servicediscovery.apple.com", "icons.axm-usercontent-apple.com" ], "notes": "[apple-mdm] Apple Business Essentials" }, { "action": "deny", "process": "any", "remote-domains": [ "vpp.itunes.apple.com" ], "notes": "[apple-mdm] Volume Purchase Program (VPP)" }, { "action": "deny", "process": "any", "remote-domains": [ "identity.apple.com" ], "notes": "[apple-mdm] MDM identity and certificate services" }, { "action": "deny", "process": "any", "remote-domains": [ "ws.school.apple.com", "ws-ee-maidsvc.icloud.com", "pg-bootstrap.itunes.apple.com", "cls-iosclient.itunes.apple.com", "cls-ingest.itunes.apple.com" ], "notes": "[apple-mdm] Classroom and Schoolwork apps" }, { "action": "deny", "process": "any", "remote-domains": [ "upload.appleschoolcontent.com" ], "notes": "[apple-mdm] SFTP uploads for school content" }, { "action": "deny", "process": "any", "remote-domains": [ "apple-mapkit.com" ], "notes": "[apple-mdm] Device location tracking (business)" }, { "action": "deny", "process": "any", "remote-domains": [ "vertexsmb.com" ], "notes": "[apple-mdm] Tax validation services" }, { "action": "deny", "process": "any", "remote-domains": [ "identity.ess.apple.com", "identity.ess-apple.com.akadns.net", "service.ess.apple.com", "service1.ess.apple.com", "service2.ess.apple.com" ], "notes": "[apple-messaging] Apple Identity Services (IDS) - key exchange and directory" }, { "action": "deny", "process": "any", "remote-domains": [ "bag.apple.com", "init-p01md.apple.com" ], "notes": "[apple-messaging] iMessage/FaceTime bag configuration" }, { "action": "deny", "process": "any", "remote-domains": [ "init-kt.apple.com", "init-kt-prod.apple.com" ], "notes": "[apple-messaging] Key Transparency - Contact Key Verification" }, { "action": "deny", "process": "any", "remote-domains": [ "icloud-content.com" ], "notes": "[apple-messaging] iCloud attachment delivery" }, { "action": "deny", "process": "any", "remote-domains": [ "music.apple.com", "api.music.apple.com", "amp-api.music.apple.com" ], "notes": "[apple-music] Apple Music streaming" }, { "action": "deny", "process": "any", "remote-domains": [ "play.itunes.apple.com", "streaming.music.apple.com", "aod.itunes.apple.com", "audio.itunes.apple.com", "aaplimg.com" ], "notes": "[apple-music] Apple Music playback" }, { "action": "deny", "process": "any", "remote-domains": [ "radio.itunes.apple.com", "radio.apple.com", "radio-activity.itunes.apple.com", "radio-services.itunes.apple.com" ], "notes": "[apple-music] Apple Music radio" }, { "action": "deny", "process": "any", "remote-domains": [ "lyrics.apple.com", "genius.com", "api.genius.com" ], "notes": "[apple-music] Apple Music lyrics and metadata" }, { "action": "deny", "process": "any", "remote-domains": [ "musickit.apple.com", "musicprofile.apple.com" ], "notes": "[apple-music] Apple Music social features" }, { "action": "deny", "process": "any", "remote-domains": [ "news.apple.com", "news-events.apple.com", "news-edge.apple.com", "news-client.apple.com", "news-api.apple.com", "apple.news" ], "notes": "[apple-news] Apple News services" }, { "action": "deny", "process": "any", "remote-domains": [ "news-events.news.apple-dns.net" ], "notes": "[apple-news] Apple News analytics" }, { "action": "deny", "process": "any", "remote-domains": [ "pos-device.apple.com" ], "notes": "[apple-pay] Tap to Pay on iPhone" }, { "action": "deny", "process": "any", "remote-domains": [ "idv.cdn-apple.com", "idv-prod1.apple.com" ], "notes": "[apple-pay] ID Verifier on iPhone" }, { "action": "deny", "process": "any", "remote-domains": [ "humb.apple.com", "wallet.cdn-apple.com", "wallet.g.aaplimg.com" ], "notes": "[apple-pay] Apple Pay setup and provisioning" }, { "action": "deny", "process": "any", "remote-domains": [ "podcasts.apple.com", "api.podcasts.apple.com", "amp-api.podcasts.apple.com" ], "notes": "[apple-podcasts] Apple Podcasts services" }, { "action": "deny", "process": "any", "remote-domains": [ "podcast.itunes.apple.com", "podcastsconnect.apple.com", "pcmaint.itunes.apple.com" ], "notes": "[apple-podcasts] Apple Podcasts playback and feeds" }, { "action": "deny", "process": "any", "remote-domains": [ "podcasts-analytics.apple.com", "podcast-edge.itunes.apple.com" ], "notes": "[apple-podcasts] Apple Podcasts analytics" }, { "action": "deny", "process": "any", "remote-domains": [ "0-courier.push.apple.com", "1-courier.push.apple.com", "2-courier.push.apple.com", "3-courier.push.apple.com", "4-courier.push.apple.com", "5-courier.push.apple.com", "6-courier.push.apple.com", "7-courier.push.apple.com", "8-courier.push.apple.com", "9-courier.push.apple.com", "10-courier.push.apple.com", "11-courier.push.apple.com", "12-courier.push.apple.com", "13-courier.push.apple.com", "14-courier.push.apple.com", "15-courier.push.apple.com", "16-courier.push.apple.com", "17-courier.push.apple.com", "18-courier.push.apple.com", "19-courier.push.apple.com", "20-courier.push.apple.com", "21-courier.push.apple.com", "22-courier.push.apple.com", "23-courier.push.apple.com", "24-courier.push.apple.com", "25-courier.push.apple.com", "26-courier.push.apple.com", "27-courier.push.apple.com", "28-courier.push.apple.com", "29-courier.push.apple.com", "30-courier.push.apple.com", "31-courier.push.apple.com", "32-courier.push.apple.com", "33-courier.push.apple.com", "34-courier.push.apple.com", "35-courier.push.apple.com", "36-courier.push.apple.com", "37-courier.push.apple.com", "38-courier.push.apple.com", "39-courier.push.apple.com", "40-courier.push.apple.com", "41-courier.push.apple.com", "42-courier.push.apple.com", "43-courier.push.apple.com", "44-courier.push.apple.com", "45-courier.push.apple.com", "46-courier.push.apple.com", "47-courier.push.apple.com", "48-courier.push.apple.com", "49-courier.push.apple.com", "50-courier.push.apple.com" ], "notes": "[apple-push-notifications] Apple Push Notification courier servers (0-50)" }, { "action": "deny", "process": "any", "remote-domains": [ "courier-push-apple.com.akadns.net" ], "notes": "[apple-push-notifications] Apple Push Notification Akamai CDN aliases" }, { "action": "deny", "process": "any", "remote-domains": [ "0-courier.sandbox.push.apple.com", "1-courier.sandbox.push.apple.com", "2-courier.sandbox.push.apple.com", "3-courier.sandbox.push.apple.com", "4-courier.sandbox.push.apple.com", "5-courier.sandbox.push.apple.com", "6-courier.sandbox.push.apple.com", "7-courier.sandbox.push.apple.com", "8-courier.sandbox.push.apple.com", "9-courier.sandbox.push.apple.com", "10-courier.sandbox.push.apple.com", "courier-sandbox-push-apple.com.akadns.net" ], "notes": "[apple-push-notifications] Apple Push Notification sandbox servers" }, { "action": "deny", "process": "any", "remote-domains": [ "init.push.apple.com", "init-p01st.push.apple.com", "init-s01st.push.apple.com" ], "notes": "[apple-push-notifications] Apple Push Notification initialization" }, { "action": "deny", "process": "any", "remote-domains": [ "us-courier.push-apple.com.akadns.net", "sjc-courier.push-apple.com.akadns.net", "pop-eur-benelux-courier.push-apple.com.akadns.net", "pop-eur-central-courier.push-apple.com.akadns.net", "pop-namer-central-courier.push-apple.com.akadns.net", "pop-namer-ne-courier.push-apple.com.akadns.net", "pop-namer-nw-courier.push-apple.com.akadns.net", "pop-namer-se-courier.push-apple.com.akadns.net" ], "notes": "[apple-push-notifications] Regional Apple Push Notification servers" }, { "action": "deny", "process": "any", "remote-domains": [ "api-kid.apple.com" ], "notes": "[apple-screentime] Screen Time web filter and usage reporting" }, { "action": "deny", "process": "any", "remote-domains": [ "guzzoni.apple.com", "origin.guzzoni-apple.com.akadns.net", "guzzoni-apple-com.v.aaplimg.com", "fr51p02sa.guzzoni-apple.com.akadns.net", "mu21p02sa.guzzoni-apple.com.akadns.net", "sp11p03sa.guzzoni-apple.com.akadns.net" ], "notes": "[apple-siri] Siri main backend servers (Guzzoni)" }, { "action": "deny", "process": "any", "remote-domains": [ "seed.siri.apple.com", "origin.seed-siri-apple.com.akadns.net" ], "notes": "[apple-siri] Siri seed/training data collection" }, { "action": "deny", "process": "any", "remote-domains": [ "siri.apple.com", "siri-api.apple.com", "siri-search.itunes.apple.com", "uts-api-siri.itunes.apple.com", "dejavu.apple.com", "dejavu.apple.com.edgekey.net", "assistant.apple.com", "assistantd.apple.com", "lookup.apple.com", "lookup-api.apple.com" ], "notes": "[apple-siri] Siri assistant services" }, { "action": "deny", "process": "any", "remote-domains": [ "dictation.apple.com", "dictation.ls.apple.com", "voicetrigger.apple.com", "voicetrigger2.apple.com", "instrumentation.apple.com" ], "notes": "[apple-siri] Dictation and voice trigger services" }, { "action": "deny", "process": "any", "remote-domains": [ "prod.siri.apple.com" ], "notes": "[apple-siri] Siri relay and backend servers" }, { "action": "deny", "process": "any", "remote-domains": [ "swallow.apple.com" ], "notes": "[apple-siri] Parsec feedback/analytics (Siri Suggestions telemetry)" }, { "action": "deny", "process": "any", "remote-domains": [ "stocks-edge.apple.com" ], "notes": "[apple-stocks] Stocks app data services" }, { "action": "deny", "process": "any", "remote-domains": [ "idiagnostics.apple.com", "idiagnostics.apple.com.akadns.net", "diagassets.apple.com", "cssubmissions.apple.com", "fba.apple.com", "bpapi.apple.com" ], "notes": "[apple-telemetry] Apple diagnostics and crash reporting" }, { "action": "deny", "process": "any", "remote-domains": [ "metrics.mzstatic.com", "dzc-metrics.mzstatic.com", "securemetrics.apple.com" ], "notes": "[apple-telemetry] Apple metrics collection" }, { "action": "deny", "process": "any", "remote-domains": [ "smoot.apple.com", "api.smoot.apple.com", "api-aka.smoot.apple.com", "api-glb.smoot.apple.com", "api-glb-ams.smoot.apple.com", "api-glb-ash.smoot.apple.com", "api-glb-atl.smoot.apple.com", "api-glb-bln.smoot.apple.com", "api-glb-dal.smoot.apple.com", "api-glb-den.smoot.apple.com", "api-glb-drf.smoot.apple.com", "api-glb-fra.smoot.apple.com", "api-glb-lax.smoot.apple.com", "api-glb-lon.smoot.apple.com", "api-glb-man.smoot.apple.com", "api-glb-nyc.smoot.apple.com", "api-glb-sea.smoot.apple.com", "api-glb-sto.smoot.apple.com", "daypass.api-aka.smoot.apple.com", "daypass.api-glb-atl.smoot.apple.com", "daypass.api-glb-lon.smoot.apple.com", "daypass.api-glb-sea.smoot.apple.com", "daypass.api-glb-sto.smoot.apple.com", "cdn.smoot.apple.com", "fbs.smoot.apple.com", "bag.smoot.apple.com", "api.smoot-apple.com.akadns.net", "smoot-feedback.v.aaplimg.com" ], "notes": "[apple-telemetry] Smoot - Apple behavioral analytics and personalization" }, { "action": "deny", "process": "any", "remote-domains": [ "xp.apple.com", "xp.itunes-apple.com.akadns.net", "xp-cdn.apple.com", "xp.v.aaplimg.com", "xp-cdn-lb.itunes-apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple experience/experiment tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "radarsubmissions.apple.com", "radarsubmissions.apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple Radar bug reporting telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "iphonesubmissions.apple.com", "iphonesubmissions.apple.com.akadns.net", "iphonesubmissions-old.apple.com" ], "notes": "[apple-telemetry] iPhone analytics submissions" }, { "action": "deny", "process": "any", "remote-domains": [ "books-analytics-events.apple.com" ], "notes": "[apple-telemetry] Apple Books analytics" }, { "action": "deny", "process": "any", "remote-domains": [ "e.crashlytics.com", "settings.crashlytics.com" ], "notes": "[apple-telemetry] Crashlytics (Google-owned crash reporting)" }, { "action": "deny", "process": "any", "remote-domains": [ "pancake.apple.com", "pancake.apple.com.edgekey.net", "pancake.cdn-apple.com.akadns.net", "pancake.g.aaplimg.com" ], "notes": "[apple-telemetry] Apple Pancake - analytics aggregation" }, { "action": "deny", "process": "any", "remote-domains": [ "silverbullet-external-ats.itunes.apple.com", "silverbullet-external-ats.itunes-apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple Silverbullet (A/B testing service)" }, { "action": "deny", "process": "any", "remote-domains": [ "basejumper.apple.com" ], "notes": "[apple-telemetry] Apple Basejumper (analytics)" }, { "action": "deny", "process": "any", "remote-domains": [ "outsideapple.apple.com", "outsideapple.apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple external services telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "init.ess.apple.com", "init.ess.apple.com.edgesuite.net", "pds-init.ess.apple.com", "query.ess.apple.com", "query.ess-apple.com.akadns.net", "profile.ess.apple.com", "profile.ess-apple.com.akadns.net", "identity.ess.apple.com", "identity.ess-apple.com.akadns.net", "static.ess.apple.com", "commnat-cohort.ess.apple.com", "commnat-cohort-gc.ess.apple.com", "commnat-main.ess.apple.com", "commnat-main-gc.ess.apple.com" ], "notes": "[apple-telemetry] Apple ESS (Experience/Experiment Sync Services)" }, { "action": "deny", "process": "any", "remote-domains": [ "mt-ingestion-service-pv.itunes.apple.com", "mt-ingestion-service-pv.itunes-apple.com.akadns.net", "mt-ingestion-service-mr22.itunes-apple.com.akadns.net", "mt-ingestion-service-st11.itunes-apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple media telemetry ingestion" }, { "action": "deny", "process": "any", "remote-domains": [ "tf-feedback.itunes.apple.com" ], "notes": "[apple-telemetry] TestFlight feedback telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "nc-pod1-smp-device.apple.com", "nc-pod1-smp-device.gcsis-apple.com.akadns.net", "smp-device-content.apple.com", "smp-device-content.g.aaplimg.com", "smp-device-content.lb-apple.com.akadns.net", "smp-device-content-us.lb-apple.com.akadns.net", "deviceservices-external.apple.com", "static.deviceservices.apple.com" ], "notes": "[apple-telemetry] Apple device management telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "ppq-new-st.oa-apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple PPQ telemetry endpoints" }, { "action": "deny", "process": "any", "remote-domains": [ "aidc.apple.com" ], "notes": "[apple-telemetry] Apple AI/ML data collection" }, { "action": "deny", "process": "any", "remote-domains": [ "internalcheck.apple.com" ], "notes": "[apple-telemetry] Apple internal check telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "static.ips.apple.com" ], "notes": "[apple-telemetry] Apple IPS (unknown telemetry)" }, { "action": "deny", "process": "any", "remote-domains": [ "ipcdn.apple.com", "ipcdn.g.aaplimg.com", "ipcdn-lb.apple.com.akadns.net" ], "notes": "[apple-telemetry] Apple Tips daemon (tipsd) - promotional content delivery" }, { "action": "deny", "process": "any", "remote-domains": [ "sas.pcms.apple.com" ], "notes": "[apple-telemetry] Apple promoted content (promotedcontentd) - suggestions and recommendations" }, { "action": "deny", "process": "any", "remote-domains": [ "time.apple.com", "time-ios.apple.com", "time-ios.g.aaplimg.com", "time-macos.apple.com", "time-osx.g.aaplimg.com" ], "notes": "[apple-time-servers] Apple NTP time servers" }, { "action": "deny", "process": "any", "remote-domains": [ "tv.apple.com", "api.tv.apple.com", "uts-api.itunes.apple.com" ], "notes": "[apple-tv] Apple TV+ streaming" }, { "action": "deny", "process": "any", "remote-domains": [ "video.apple.com", "hls.itunes.apple.com", "hls-amt.itunes.apple.com", "mvod.itunes.apple.com" ], "notes": "[apple-tv] Apple TV video playback" }, { "action": "deny", "process": "any", "remote-domains": [ "play-edge.itunes.apple.com", "play.itunes.apple.com", "np-edge.itunes.apple.com" ], "notes": "[apple-tv] Apple TV content delivery" }, { "action": "deny", "process": "any", "remote-domains": [ "uts.itunes.apple.com", "bag.itunes.apple.com", "umc-world-client-ssl.apple.com" ], "notes": "[apple-tv] Apple TV channels and partners" }, { "action": "deny", "process": "any", "remote-domains": [ "app-site-association.cdn-apple.com", "app-site-association.apple.com", "app-site-association.networking.apple" ], "notes": "[apple-universal-links] Associated Domains for Universal Links" }, { "action": "deny", "process": "any", "remote-domains": [ "sylvan.apple.com", "sylvan.g.aaplimg.com", "sylvan.apple.com.akadns.net" ], "notes": "[apple-wallpapers] Aerial screensavers and wallpapers" }, { "action": "deny", "process": "any", "remote-domains": [ "weather-data.apple.com", "weather-data-origin.apple.com", "weather.apple.com", "weather-edge.apple.com" ], "notes": "[apple-weather] Apple Weather data services" }, { "action": "deny", "process": "any", "remote-domains": [ "weather-map.apple.com", "weather-map2.apple.com", "weatherkit.apple.com", "weatherkit-analytics.apple.com" ], "notes": "[apple-weather] Apple Weather API" }, { "action": "deny", "process": "any", "remote-domains": [ "api.darksky.net", "darksky.net" ], "notes": "[apple-weather] Dark Sky (Apple's weather backend)" }, { "action": "deny", "process": "any", "remote-domains": [ "safebrowsing.brave.com", "safebrowsing2.brave.com", "safebrowsing.bravesoftware.com" ], "notes": "[brave-safe-browsing] Brave Safe Browsing" }, { "action": "deny", "process": "any", "remote-domains": [ "p3a.brave.com", "p3a-json.brave.com", "p3a-creative.brave.com" ], "notes": "[brave-telemetry] Brave P3A telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "star-randsrv.brave.com", "star-randsrv.bravesoftware.com" ], "notes": "[brave-telemetry] Brave STAR randomized telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "componentupdater.brave.com", "go-updater.brave.com", "updates.brave.com", "updates-cdn.brave.com", "updates.bravesoftware.com", "laptop-updates.brave.com", "laptop-updates-staging.brave.com" ], "notes": "[brave-telemetry] Brave component and browser updates" }, { "action": "deny", "process": "any", "remote-domains": [ "variations.brave.com", "variations.bravesoftware.com" ], "notes": "[brave-telemetry] Brave variations/experiments" }, { "action": "deny", "process": "any", "remote-domains": [ "static.brave.com", "static1.brave.com", "static2.brave.com" ], "notes": "[brave-telemetry] Brave static content" }, { "action": "deny", "process": "any", "remote-domains": [ "brave-core-ext.s3.brave.com", "brave-today-cdn.brave.com", "pcdn.brave.com" ], "notes": "[brave-telemetry] Brave extensions and Brave Today" }, { "action": "deny", "process": "any", "remote-domains": [ "ads.brave.com", "ads-serve.brave.com", "ads-static.brave.com", "mywallet.ads.brave.com", "grant.rewards.brave.com", "rewards.brave.com" ], "notes": "[brave-telemetry] Brave Ads and Rewards" }, { "action": "deny", "process": "any", "remote-domains": [ "api.brave.com", "api.brave.software", "api.bravesoftware.com" ], "notes": "[brave-telemetry] Brave API services" }, { "action": "deny", "process": "any", "remote-domains": [ "sync-v2.brave.com", "sync.brave.com", "sync.bravesoftware.com" ], "notes": "[brave-telemetry] Brave Sync" }, { "action": "deny", "process": "any", "remote-domains": [ "cr.brave.com", "cr.bravesoftware.com" ], "notes": "[brave-telemetry] Brave crash reporting" }, { "action": "deny", "process": "any", "remote-domains": [ "geo.brave.com", "location.brave.com", "location.bravesoftware.com" ], "notes": "[brave-telemetry] Brave geolocation" }, { "action": "deny", "process": "any", "remote-domains": [ "search.brave.com", "cdn.search.brave.com" ], "notes": "[brave-telemetry] Brave Search" }, { "action": "deny", "process": "any", "remote-domains": [ "clients1.google.com", "clients2.google.com", "clients3.google.com", "clients4.google.com", "clients5.google.com", "clients6.google.com" ], "notes": "[chrome-telemetry] Chrome update and telemetry clients" }, { "action": "deny", "process": "any", "remote-domains": [ "update.googleapis.com", "clientservices.googleapis.com", "chromecontentsuggestions-pa.googleapis.com", "chromereporting-pa.googleapis.com", "chromedesktop.googleapis.com" ], "notes": "[chrome-telemetry] Chrome update services" }, { "action": "deny", "process": "any", "remote-domains": [ "optimizationguide-pa.googleapis.com", "content-autofill.googleapis.com", "passwordsleakcheck-pa.googleapis.com", "crashpad.googleapis.com" ], "notes": "[chrome-telemetry] Chrome optimization and features" }, { "action": "deny", "process": "any", "remote-domains": [ "chrome.google.com", "dl.google.com", "tools.google.com" ], "notes": "[chrome-telemetry] Chrome downloads and tools" }, { "action": "deny", "process": "any", "remote-domains": [ "chromium-i18n.appspot.com", "chromium.googlesource.com" ], "notes": "[chrome-telemetry] Chromium services" }, { "action": "deny", "process": "any", "remote-domains": [ "adservice.google.com", "adservice.google.co.uk", "adservice.google.de", "adservice.google.fr", "adservice.google.ca", "adservice.google.com.au", "adservice.google.co.in", "adservice.google.co.jp", "adservice.google.com.br", "adservice.google.es", "adservice.google.it", "adservice.google.nl", "adservice.google.pl", "adservice.google.ru", "googleadservices.com", "www.googleadservices.com", "partner.googleadservices.com" ], "notes": "[google-ads] Google Ad Services" }, { "action": "deny", "process": "any", "remote-domains": [ "pagead2.googlesyndication.com", "pagead.googlesyndication.com", "afs.googlesyndication.com", "www.googlesyndication.com", "googlesyndication.com", "tpc.googlesyndication.com", "googlesyndication.l.google.com", "pixel.googlesyndication.com", "video-ad-stats.googlesyndication.com" ], "notes": "[google-ads] Google Syndication" }, { "action": "deny", "process": "any", "remote-domains": [ "pagead.l.doubleclick.net", "googleads.g.doubleclick.net", "googleads2.g.doubleclick.net", "googleads3.g.doubleclick.net", "googleads4.g.doubleclick.net", "ad.doubleclick.net", "doubleclick.net", "securepubads.g.doubleclick.net", "pubads.g.doubleclick.net", "adclick.g.doubleclick.net", "cm.g.doubleclick.net", "ad.mo.doubleclick.net", "ad-g.doubleclick.net", "survey.g.doubleclick.net", "surveys.g.doubleclick.net" ], "notes": "[google-ads] DoubleClick ad network" }, { "action": "deny", "process": "any", "remote-domains": [ "s0.2mdn.net", "s1.2mdn.net", "2mdn.net" ], "notes": "[google-ads] Google 2mdn ad serving" }, { "action": "deny", "process": "any", "remote-domains": [ "adwords.google.com", "adwords.l.google.com", "adsense.google.com", "partnerad.l.google.com" ], "notes": "[google-ads] AdWords and AdSense" }, { "action": "deny", "process": "any", "remote-domains": [ "pagead.l.google.com", "pagead-googlehosted.l.google.com" ], "notes": "[google-ads] Google PageAd" }, { "action": "deny", "process": "any", "remote-domains": [ "ad.youtube.com", "ads.youtube.com", "redirector.googlevideo.com" ], "notes": "[google-ads] YouTube ads" }, { "action": "deny", "process": "any", "remote-domains": [ "imasdk.googleapis.com" ], "notes": "[google-ads] Google IMA SDK (video ads)" }, { "action": "deny", "process": "any", "remote-domains": [ "safebrowsing.googleapis.com", "safebrowsing.google.com", "safebrowsing-cache.google.com", "sb-ssl.google.com" ], "notes": "[google-safe-browsing] Google Safe Browsing" }, { "action": "deny", "process": "any", "remote-domains": [ "www.google-analytics.com", "google-analytics.com", "ssl.google-analytics.com", "analytics.google.com" ], "notes": "[google-telemetry] Google Analytics" }, { "action": "deny", "process": "any", "remote-domains": [ "tagmanager.google.com", "www.googletagmanager.com", "googletagservices.com" ], "notes": "[google-telemetry] Google Tag Manager" }, { "action": "deny", "process": "any", "remote-domains": [ "beacons.gcp.gvt2.com", "beacons.gvt2.com", "beacons2.gvt2.com", "beacons3.gvt2.com", "beacons4.gvt2.com", "beacons5.gvt2.com", "beacons.gvt3.com" ], "notes": "[google-telemetry] Google beacons/tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "www.googleoptimize.com", "googleoptimize.com", "optimize.google.com", "app-measurement.com" ], "notes": "[google-telemetry] Google Optimize and app measurement" }, { "action": "deny", "process": "any", "remote-domains": [ "firebase-settings.crashlytics.com", "firebaseinstallations.googleapis.com", "firebaselogging.googleapis.com", "firebaselogging-pa.googleapis.com", "firebase.googleapis.com", "fcm.googleapis.com", "firebaseremoteconfig.googleapis.com" ], "notes": "[google-telemetry] Firebase services" }, { "action": "deny", "process": "any", "remote-domains": [ "surveys.google.com", "csp.withgoogle.com", "ogs.google.com", "feedbackextension.google.com" ], "notes": "[google-telemetry] Google surveys and feedback" }, { "action": "deny", "process": "any", "remote-domains": [ "id.google.com", "id.google.co.uk", "id.google.com.au", "fundingchoicesmessages.google.com", "contributor.google.com" ], "notes": "[google-telemetry] Google ID tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "s.youtube.com", "video-stats.l.google.com" ], "notes": "[google-telemetry] YouTube stats/tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "ampcid.google.com", "ampproject.org", "cdn.ampproject.org", "amp.google.com" ], "notes": "[google-telemetry] Google AMP tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "userlocation.googleapis.com", "geolocation.googleapis.com" ], "notes": "[google-telemetry] Google geolocation services" }, { "action": "deny", "process": "any", "remote-domains": [ "telemetry.microsoft.com", "vortex.data.microsoft.com", "vortex-win.data.microsoft.com", "telecommand.telemetry.microsoft.com", "watson.telemetry.microsoft.com", "watson.microsoft.com", "umwatsontest.events.data.microsoft.com", "ceuswatcab01.blob.core.windows.net", "ceuswatcab02.blob.core.windows.net" ], "notes": "[microsoft-telemetry] Microsoft telemetry endpoints" }, { "action": "deny", "process": "any", "remote-domains": [ "settings-win.data.microsoft.com", "v10.events.data.microsoft.com", "v20.events.data.microsoft.com", "events.data.microsoft.com", "diagnostics.support.microsoft.com" ], "notes": "[microsoft-telemetry] Microsoft diagnostics" }, { "action": "deny", "process": "any", "remote-domains": [ "feedback.microsoft-hohm.com", "feedback.windows.com", "feedback.search.microsoft.com", "survey.watson.microsoft.com" ], "notes": "[microsoft-telemetry] Microsoft feedback and surveys" }, { "action": "deny", "process": "any", "remote-domains": [ "ads.bing.com", "a.ads2.msads.net", "ads.msn.com", "adnxs.com", "c.msn.com", "c.bing.com" ], "notes": "[microsoft-telemetry] Microsoft Bing tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "choice.microsoft.com", "choice.microsoft.com.nstac.net", "df.telemetry.microsoft.com", "reports.wes.df.telemetry.microsoft.com", "redir.metaservices.microsoft.com", "c.atdmt.com", "atdmt.com", "flex.msn.com", "g.msn.com" ], "notes": "[microsoft-telemetry] Microsoft advertising" }, { "action": "deny", "process": "any", "remote-domains": [ "smartscreen.microsoft.com", "smartscreen-prod.microsoft.com", "urs.microsoft.com", "urs.smartscreen.microsoft.com" ], "notes": "[microsoft-telemetry] Microsoft SmartScreen (web filter)" }, { "action": "deny", "process": "any", "remote-domains": [ "activity.windows.com", "edge.activity.windows.com" ], "notes": "[microsoft-telemetry] Microsoft account activity" }, { "action": "deny", "process": "any", "remote-domains": [ "cortana.ai", "www.cortana.ai", "cortana.search.msn.com" ], "notes": "[microsoft-telemetry] Cortana and search" }, { "action": "deny", "process": "any", "remote-domains": [ "nexus.officeapps.live.com", "nexusrules.officeapps.live.com", "mobile.pipe.aria.microsoft.com", "office.pipe.aria.microsoft.com", "browser.pipe.aria.microsoft.com" ], "notes": "[microsoft-telemetry] Office telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "arc.msn.com", "ris.api.iris.microsoft.com", "query.prod.cms.rt.microsoft.com" ], "notes": "[microsoft-telemetry] Windows Spotlight and tips" }, { "action": "deny", "process": "any", "remote-domains": [ "dc.services.visualstudio.com", "vscode.dev", "default.exp-tas.com", "vscode-sync.trafficmanager.net", "vscode-sync-insiders.trafficmanager.net", "vscode.blob.core.windows.net", "az764295.vo.msecnd.net", "vscode.download.prss.microsoft.com" ], "notes": "[microsoft-telemetry] VS Code telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "vscode.search.windows.net", "vsmarketplacebadges.dev" ], "notes": "[microsoft-telemetry] VS Code crash reporting" }, { "action": "deny", "process": "any", "remote-domains": [ "shavar.services.mozilla.com", "shavar.prod.mozaws.net", "tracking-protection.cdn.mozilla.net", "tracking.services.mozilla.com" ], "notes": "[mozilla-safe-browsing] Mozilla Safe Browsing and Tracking Protection" }, { "action": "deny", "process": "any", "remote-domains": [ "incoming.telemetry.mozilla.org", "telemetry.mozilla.org", "telemetry-coverage.mozilla.org", "telemetry-incoming.r53-2.services.mozilla.com", "prod.ohttp-gateway.prod.webservices.mozgcp.net" ], "notes": "[mozilla-telemetry] Mozilla core telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "crash-reports.mozilla.com", "crash-stats.mozilla.org", "crash-stats.mozilla.com", "socorro.services.mozilla.com" ], "notes": "[mozilla-telemetry] Mozilla crash reporting" }, { "action": "deny", "process": "any", "remote-domains": [ "normandy.cdn.mozilla.net", "normandy.services.mozilla.com", "normandy-cdn.services.mozilla.com", "normandy.tombstone.experimenter.prod.webservices.mozgcp.net", "self-repair.mozilla.org" ], "notes": "[mozilla-telemetry] Mozilla Normandy experiments" }, { "action": "deny", "process": "any", "remote-domains": [ "push.services.mozilla.com", "autopush.stage.mozaws.net", "autopush.prod.mozaws.net", "updates.push.services.mozilla.com" ], "notes": "[mozilla-telemetry] Mozilla push notifications" }, { "action": "deny", "process": "any", "remote-domains": [ "discovery.addons.mozilla.org", "services.addons.mozilla.org", "versioncheck.addons.mozilla.org", "versioncheck-bg.addons.mozilla.org" ], "notes": "[mozilla-telemetry] Mozilla addon discovery" }, { "action": "deny", "process": "any", "remote-domains": [ "experiments.mozilla.org", "data.mozilla.com", "dataops.mozgcp.net", "analysis.telemetry.mozilla.org" ], "notes": "[mozilla-telemetry] Mozilla experiments and analytics" }, { "action": "deny", "process": "any", "remote-domains": [ "ads.mozilla.org", "ads-img.mozilla.org", "contile.services.mozilla.com", "contile-images.services.mozilla.com", "spocs.getpocket.com", "spocs.getpocket.dev", "getpocket.cdn.mozilla.net", "getpocket.com", "img-getpocket.cdn.mozilla.net", "widgets.getpocket.com", "pocket.prod.cloudops.mozgcp.net" ], "notes": "[mozilla-telemetry] Pocket and sponsored content" }, { "action": "deny", "process": "any", "remote-domains": [ "snippets.cdn.mozilla.net", "snippets.mozilla.com", "snippets-prod.moz.works", "activity-stream-icons.services.mozilla.com" ], "notes": "[mozilla-telemetry] Firefox snippets and activity stream" }, { "action": "deny", "process": "any", "remote-domains": [ "suggest.mozilla.org", "merino.services.mozilla.com", "prod-images.merino.prod.webservices.mozgcp.net", "firefox.settings.services.mozilla.com", "firefox-settings-attachments.cdn.mozilla.net" ], "notes": "[mozilla-telemetry] Firefox Suggest and settings" }, { "action": "deny", "process": "any", "remote-domains": [ "location.services.mozilla.com", "location-learnmore.services.mozilla.com" ], "notes": "[mozilla-telemetry] Mozilla location services" }, { "action": "deny", "process": "any", "remote-domains": [ "classify-client.services.mozilla.com", "content-signature-2.cdn.mozilla.net", "detectportal.firefox.com" ], "notes": "[mozilla-telemetry] Mozilla client classification" }, { "action": "deny", "process": "any", "remote-domains": [ "coverage.mozilla.org", "qsurvey.mozilla.com", "input.mozilla.org", "reporter.mozilla.org", "talkback-reports.mozilla.org", "talkback-public.mozilla.org" ], "notes": "[mozilla-telemetry] Mozilla surveys and feedback" }, { "action": "deny", "process": "any", "remote-domains": [ "stats.mozilla.org", "download-stats.mozilla.org" ], "notes": "[mozilla-telemetry] Mozilla statistics and download tracking" }, { "action": "deny", "process": "any", "remote-domains": [ "fhr.data.mozilla.com", "healthreport.mozilla.com" ], "notes": "[mozilla-telemetry] Firefox Health Report (legacy)" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.apple.com", "ocsp2.apple.com", "valid.apple.com" ], "notes": "[ocsp] Apple OCSP servers" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.comodoca.com", "ocsp.sectigo.com", "ocsp.usertrust.com", "ocsp.comodo.com" ], "notes": "[ocsp] Comodo/Sectigo OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.digicert.com", "ocsp.digicert.cn", "cacerts.digicert.com" ], "notes": "[ocsp] DigiCert OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.letsencrypt.org", "r3.o.lencr.org", "e1.o.lencr.org", "r4.o.lencr.org", "e2.o.lencr.org" ], "notes": "[ocsp] Let's Encrypt OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.globalsign.com", "ocsp2.globalsign.com" ], "notes": "[ocsp] GlobalSign OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.geotrust.com", "ocsp.rapidssl.com" ], "notes": "[ocsp] GeoTrust/RapidSSL OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.entrust.net" ], "notes": "[ocsp] Entrust OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.godaddy.com", "ocsp.starfieldtech.com" ], "notes": "[ocsp] GoDaddy OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.verisign.com", "ocsp.thawte.com", "ocsp.ws.symantec.com" ], "notes": "[ocsp] Symantec/VeriSign/Thawte OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.msocsp.com" ], "notes": "[ocsp] Microsoft OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.rootca1.amazontrust.com", "ocsp.rootg2.amazontrust.com", "ocsp.sca1a.amazontrust.com", "ocsp.sca1b.amazontrust.com", "o.ss2.us" ], "notes": "[ocsp] Amazon Trust Services OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.cloudflare.com" ], "notes": "[ocsp] Cloudflare OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.pki.goog", "o.pki.goog" ], "notes": "[ocsp] Google Trust Services OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.buypass.com", "ocsp.buypassca.com" ], "notes": "[ocsp] Buypass OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.quovadisoffshore.com", "ocsp.quovadisglobal.com" ], "notes": "[ocsp] QuoVadis OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.ssl.com" ], "notes": "[ocsp] SSL.com OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "ocsp.trustwave.com" ], "notes": "[ocsp] Trustwave OCSP" }, { "action": "deny", "process": "any", "remote-domains": [ "tbsc.apple.com", "tbsc.apple.com.akadns.net" ], "notes": "[ocsp] Apple Trust Services (certificate transparency)" }, { "action": "deny", "process": "any", "remote-domains": [ "certs.apple.com", "crl.apple.com", "crl3.digicert.com", "crl4.digicert.com" ], "notes": "[ocsp] Certificate Revocation Lists" }, { "action": "deny", "process": "any", "remote-domains": [ "telemetry.opera.com", "telemetry-2.opera.com", "telemetry-3.opera.com" ], "notes": "[opera-telemetry] Opera core telemetry" }, { "action": "deny", "process": "any", "remote-domains": [ "autoupdate.geo.opera.com", "autoupdate.opera.com", "update.opera.com" ], "notes": "[opera-telemetry] Opera auto-update" }, { "action": "deny", "process": "any", "remote-domains": [ "sitecheck2.opera.com", "sitecheck.opera.com" ], "notes": "[opera-telemetry] Opera site check" }, { "action": "deny", "process": "any", "remote-domains": [ "partner-content.opera.com", "speeddials.opera.com", "extension-updates.opera.com", "addons.opera.com" ], "notes": "[opera-telemetry] Opera partner content and extensions" }, { "action": "deny", "process": "any", "remote-domains": [ "ads.opera.com", "oaads.opera.com", "ads-exchange.opera.com" ], "notes": "[opera-telemetry] Opera advertising" }, { "action": "deny", "process": "any", "remote-domains": [ "desktop-feed.opera.com", "desktop-feed-pa.opera.com", "news.opera.com", "news-sources.opera.com" ], "notes": "[opera-telemetry] Opera news feed" }, { "action": "deny", "process": "any", "remote-domains": [ "suggestion.opera.com", "suggestions.opera.com", "search.opera.com" ], "notes": "[opera-telemetry] Opera search suggestions" }, { "action": "deny", "process": "any", "remote-domains": [ "geoloc.opera.com", "geolocation.otsync.cz" ], "notes": "[opera-telemetry] Opera geolocation" }, { "action": "deny", "process": "any", "remote-domains": [ "browser.opera.com", "browser-api.opera.com", "api.opera.com" ], "notes": "[opera-telemetry] Opera browser API" }, { "action": "deny", "process": "any", "remote-domains": [ "crypto.opera.com", "crypto-wallet.opera.com" ], "notes": "[opera-telemetry] Opera crypto wallet" }, { "action": "deny", "process": "any", "remote-domains": [ "configuration.ls.apple.com" ], "notes": "[safari-telemetry] Safari configuration" }, { "action": "deny", "process": "any", "remote-domains": [ "safebrowsing.apple.com", "token.safebrowsing.apple" ], "notes": "[safari-telemetry] Safari Safe Browsing" }, { "action": "deny", "process": "any", "remote-domains": [ "p.typekit.net", "use.typekit.net" ], "notes": "[safari-telemetry] Adobe Typekit fonts (used by Safari)" }, { "action": "deny", "process": "any", "remote-domains": [ "wps.apple.com" ], "notes": "[safari-telemetry] Safari Web Push Service" }, { "action": "deny", "process": "any", "remote-domains": [ "pba.apple.com", "pba0.apple.com", "pba1.apple.com", "pba2.apple.com" ], "notes": "[safari-telemetry] Safari Password Breach checking service" }, { "action": "allow", "process": "any", "remote-domains": [ "apps.apple.com", "itunes.apple.com", "mzstatic.com" ], "disabled": false, "notes": "[apple-appstore] App Store main services" }, { "action": "allow", "process": "any", "remote-domains": [ "buy.itunes.apple.com", "su.itunes.apple.com", "sp.itunes.apple.com" ], "disabled": false, "notes": "[apple-appstore] App Store purchases" }, { "action": "allow", "process": "any", "remote-domains": [ "search.itunes.apple.com", "amp-api.apps.apple.com", "amp-api-edge.apps.apple.com", "amp-api-search-edge.apps.apple.com" ], "disabled": false, "notes": "[apple-appstore] App Store search and discovery" }, { "action": "allow", "process": "any", "remote-domains": [ "s.mzstatic.com" ], "disabled": false, "notes": "[apple-appstore] App Store assets and content" }, { "action": "allow", "process": "any", "remote-domains": [ "testflight.apple.com", "beta.apple.com", "appstoreconnect.apple.com" ], "disabled": false, "notes": "[apple-appstore] TestFlight beta distribution" }, { "action": "allow", "process": "any", "remote-domains": [ "itunesconnect.apple.com", "contentdelivery.itunes.apple.com" ], "disabled": false, "notes": "[apple-appstore] App Store Connect and developer" }, { "action": "allow", "process": "any", "remote-domains": [ "ppq.apple.com" ], "disabled": false, "notes": "[apple-appstore] Enterprise app validation" }, { "action": "allow", "process": "any", "remote-domains": [ "appattest.apple.com" ], "disabled": false, "notes": "[apple-appstore] App attestation and validation" }, { "action": "allow", "process": "any", "remote-domains": [ "apps-marketplace.apple.com" ], "disabled": false, "notes": "[apple-appstore] Alternative app marketplaces (EU)" }, { "action": "allow", "process": "any", "remote-domains": [ "swscan.apple.com", "swscan.apple.com.akadns.net", "swquery.apple.com", "swdownload.apple.com", "swpost.apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple Software Update scanning and catalog" }, { "action": "allow", "process": "any", "remote-domains": [ "swcdn.apple.com", "swcdn.apple.com.akadns.net", "swcdn.g.aaplimg.com" ], "disabled": false, "notes": "[apple-software-updates] Apple Software Update CDN" }, { "action": "allow", "process": "any", "remote-domains": [ "swdist.apple.com", "swdist.apple.com.akadns.net" ], "disabled": false, "notes": "[apple-software-updates] Apple Software Update distribution" }, { "action": "allow", "process": "any", "remote-domains": [ "mesu.apple.com", "mesu.apple.com.akadns.net", "mesu.g.aaplimg.com", "mesu-cdn.apple.com.akadns.net", "mesu-cdn.origin-apple.com.akadns.net" ], "disabled": false, "notes": "[apple-software-updates] Apple mobile/macOS software update" }, { "action": "allow", "process": "any", "remote-domains": [ "updates.cdn-apple.com", "updates-http.cdn-apple.com", "updates.apple.com", "tahoe.cdn-apple.com", "sequoia.cdn-apple.com", "sonoma.cdn-apple.com", "ventura.cdn-apple.com", "monterey.cdn-apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple OS updates CDN" }, { "action": "allow", "process": "any", "remote-domains": [ "appldnld.apple.com", "appldnld.apple.com.edgesuite.net" ], "disabled": false, "notes": "[apple-software-updates] Apple downloads" }, { "action": "allow", "process": "any", "remote-domains": [ "oscdn.apple.com", "osrecovery.apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple OS recovery and CDN" }, { "action": "allow", "process": "any", "remote-domains": [ "suconfig.apple.com", "suconfig.apple.com.akadns.net" ], "disabled": false, "notes": "[apple-software-updates] Apple software update configuration" }, { "action": "allow", "process": "any", "remote-domains": [ "gdmf.apple.com", "gdmf.apple.com.akadns.net", "gdmf-ados.apple.com", "gg.apple.com", "gnf-mdn.apple.com", "gnf-mr.apple.com", "ig.apple.com", "gs.apple.com", "gsra.apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple asset and catalog servers (GDMF)" }, { "action": "allow", "process": "any", "remote-domains": [ "skl.apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple macOS update components" }, { "action": "allow", "process": "any", "remote-domains": [ "wkms-public.apple.com", "fcs-keys-pub-prod.cdn-apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple device-attached installation and verification" }, { "action": "allow", "process": "any", "remote-domains": [ "devimages-cdn.apple.com", "developer.apple.com", "download.developer.apple.com" ], "disabled": false, "notes": "[apple-software-updates] Apple Xcode and developer updates" } ] }