Research Assistant

A connection alert tells you which process wants to connect to which server, but not what the connection is for. If the developer of the app supplies an Internet Access Policy, you find the answer there. For all other apps, the Research Assistant can give you additional information about the process and the server to help you decide whether to allow or deny the connection.

You find the Research Assistant button in the row of buttons at the top right of the alert. On the keyboard, press H or ?.

Ask the Research Assistant

1. In the connection alert, click the Research Assistant button.

   Nothing is sent yet. First, Little Snitch explains what will happen: the connection details will be sent to a server of Objective Development.

   

2. To see the data before it’s sent, click What will be transmitted?. Little Snitch shows the data exactly as it will be sent.

3. To read how Objective Development uses the data, click Privacy Statement.

4. Click Ask Research Assistant to send your request.

5. Read the answer. In this example, it tells you what the app and the server are and what happens if you deny the connection.

   

6. Allow or deny the connection as usual.

If you close or answer the alert before you click Ask Research Assistant, Little Snitch transmits nothing.

If Little Snitch Agent needs a connection

The question goes from Little Snitch Agent to research.obdev.at, a server operated by Objective Development in the European Union. Your rules apply to this connection like to any other. If no rule allows it, the Research Assistant can’t send the question, and shows a message with an Allow button instead:

Click Allow. Little Snitch creates a rule that allows this connection, and the Research Assistant sends the question.

What Little Snitch transmits

The question contains only what’s needed to identify the process and the server:

• The name of the process that wants to connect. That’s only the file name, never the full path. For a script inside a bundle, it’s the path starting at the bundle, for example Foo.app/Contents/Resources/run.sh. For a Java app, it’s the name of the .app.
• The Code ID of the process and the Team Identifier of its developer, but only if Little Snitch identifies the process by its code signature. Otherwise, Little Snitch sends only the name.
• The same items for the helper process, if the app connects through one.
• The hostname or the IP address of the server, and which of the two it is.
• The direction of the connection, incoming or outgoing.
• The port, if Little Snitch knows it.
• The protocol (ICMP, TCP, UDP, or SCTP), if Little Snitch knows it.
• The language of your Mac, so that the assistant answers in your language.
• A fixed string "alert" to allow future extensions.

Little Snitch never transmits a full path, a user name, or any part of your rules.

The data is sent in JSON format. This example shows the data for the command ping obdev.at in Terminal, where the helper process ping makes the connection for Terminal. There’s no port, because ICMP doesn’t use ports.

{
  "isInbound": false,
  "languageCode": "en",
  "primaryExecutable": {
    "codeIdentifier": "com.apple.Terminal",
    "name": "Terminal",
    "teamIdentifier": "APPLE"
  },
  "remoteEndpoint": "obdev.at",
  "remoteEndpointKind": "hostname",
  "requestingComponent": "alert",
  "transportLayerProtocol": "icmp",
  "viaExecutable": {
    "codeIdentifier": "com.apple.ping",
    "name": "ping",
    "teamIdentifier": "APPLE"
  }
}

© 2016-2026 by Objective Development Software GmbH