{"owner":"evilsocket","repo":"opensnitch","hasSkills":true,"totalSkillsCount":11,"totalTokensCount":4772,"categories":["plugin-manifest","anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":["ui/opensnitch/plugins/virustotal/README.md","daemon/data/rules/000-allow-localhost6.json","ui/opensnitch/plugins/downloader/example/downloaders.json","daemon/data/rules/000-allow-localhost.json","ui/opensnitch/plugins/highlight/README.md","ui/opensnitch/plugins/versionchecker/versionchecker.json","ui/opensnitch/plugins/highlight/example/commonActionsDelegate.json","ui/opensnitch/plugins/highlight/example/rulesActionsDelegate.json","ui/opensnitch/plugins/list_subscriptions/example/hagezi-light.txt.meta.json","ui/opensnitch/plugins/list_subscriptions/example/list_subscriptions.json","ui/opensnitch/plugins/virustotal/example/virustotal.json"],"skills":{"ui/opensnitch/plugins/virustotal/README.md":"## VirusTotal plugin\n\nThis is a simple plugin that analyzes new outbound connections with virustotal:\n\n\"9-vt-1\"\n\n\n
It also obtains information about domains in the Hosts tab:\n\n\"hosts-vt\"\n\n\n
and adds a tab to the process dialog, which obtains information about the process if the hash was submitted to virustotal.\n\n\"8-vt-1\"\n\n\n
**Privacy warning:** remember that the domains, IPs or hashes will be sent to the servers of virustotal.\n\n## Prerequisites\n\nGet an API key: https://virustotal.readme.io/docs/please-give-me-an-api-key\n\n## Configuration\n\nFirstly add a new rule to allow connections from the GUI to www.virustotal.com:\n\n```json\n{\n \"created\": \"2023-02-19T20:44:36.000000Z\",\n \"name\": \"allow-virustotal\",\n \"enabled\": true,\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"type\": \"list\",\n \"operand\": \"list\",\n \"list\": [\n {\n \"type\": \"simple\",\n \"operand\": \"dest.port\",\n \"data\": \"443\"\n },\n {\n \"type\": \"simple\",\n \"operand\": \"dest.host\",\n \"data\": \"www.virustotal.com\"\n }\n ]\n }\n}\n```\n\nSecondly, create the plugin configuration under `/home//.config/opensnitch/actions/virustotal.json`:\n\n```json\n{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections properties with virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"ips\", \"domains\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": true,\n \"use-reputation\": true,\n \"use-suspicious\": true\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [\"127.\", \"192.168.\"],\n \"domains\": [\".lan\"]\n }\n }\n }\n}\n```\n\n|item|value|\n|----|-----|\n|config.api_timeout|maximum allowed time in seconds to obtain a response from the server. 1 is usually too low. 2 or 3 usually works fine.|\n|config.api_quota| Maximum allowed requests. If we exceed this value, we won't try to analyze new connections (they'll be denied anyway). The free account has a limit of 500. If you use a different license, adjust this value accordingly.|\n|malicious.icon|Change the icon of the popup if the connection is flagged as malicious. Leave empty to skip it. The name of the icon depends on the icon theme of your Desktop Environment|\n|malicious.minimum-threshold|The minimum malicious score used to consider an outbound connection potentially malicious.|\n|malicious.use-community-score|Users can vote to flag something as malicious or not (IP, domain, hash, etc).|\n|malicious.use-reputation||\n|exclusions.ips|IPs to exclude from being analyzed. By default private IPs are already excluded. The exclusion will take effect if the IP contains the exclusion|\n|exclusions.domains|Domains to exclude from being analyzed. The exclusion will take effect if the domain contains the exclusion (for example: www.github.com.lan)|\n\n#### API Documentation: \n\n - https://developers.virustotal.com/reference/domain-info\n - https://developers.virustotal.com/reference/domains-1\n - https://developers.virustotal.com/reference/ip-info\n - https://docs.virustotal.com/reference/ip-object\n - https://developers.virustotal.com/reference/file-info\n - https://docs.virustotal.com/reference/files\n","daemon/data/rules/000-allow-localhost6.json":"{\n \"created\": \"2025-04-09T23:17:39-06:00\",\n \"updated\": \"2025-04-09T23:17:39-06:00\",\n \"name\": \"000-allow-localhost6\",\n \"description\": \"Allow connections to localhost. More information:\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"::1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","ui/opensnitch/plugins/downloader/example/downloaders.json":"{\n \"name\": \"downloadersActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"download ads/malware lists, save them to a local directory, and create a rule to filter by lists in that directory\",\n \"type\": [\"global\"],\n \"actions\": {\n \"downloader\": {\n \"enabled\": true,\n \"config\": [\n {\n \"name\": \"update ads lists\",\n \"interval\": \"6\",\n \"units\": \"hours\",\n \"urls\": [\n {\n \"name\": \"adaway\",\n \"enabled\": true,\n \"remote\": \"https://adaway.org/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-adaway-hosts.txt\"\n },\n {\n \"name\": \"developerdan\",\n \"enabled\": true,\n \"remote\": \"https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt\",\n \"localfile\": \"/tmp/blocklist/ads-tracking-aggressive-extended.txt\"\n },\n {\n \"name\": \"1hosts\",\n \"enabled\": true,\n \"remote\": \"https://raw.githubusercontent.com/badmojr/1Hosts/master/Pro/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-1hosts.txt\"\n },\n {\n \"name\": \"frogeye multipary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-multiparty.txt\"\n },\n {\n \"name\": \"frogeye firstpary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-firstparty.txt\"\n },\n {\n \"name\": \"urlhaus\",\n \"enabled\": true,\n \"remote\": \"https://urlhaus.abuse.ch/downloads/hostfile/\",\n \"localfile\": \"/tmp/blocklist/urlhaus-hosts.txt\"\n },\n {\n \"name\": \"pgl.yoyo.org\",\n \"enabled\": true,\n \"remote\": \"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext\",\n \"localfile\": \"/tmp/blocklist/pgl.yoyo.txt\"\n }\n ],\n \"notify\": {\n \"success\": {\n \"desktop\": \"Blocklists updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating blocklists\"\n }\n }\n } \n ]\n }\n }\n}\n","daemon/data/rules/000-allow-localhost.json":"{\n \"created\": \"2025-04-09T23:21:35-06:00\",\n \"updated\": \"2025-04-09T23:21:35-06:00\",\n \"name\": \"000-allow-localhost\",\n \"description\": \"Allow connections to localhost. More information:\\n\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"127.0.0.1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","ui/opensnitch/plugins/highlight/README.md":"## Highlight plugin\n\nA plugin to colorize rows or cells of the GUI based on patterns.\n\n\"Captura\n\n
There're 4 built-in configurations, used to highlight parts of the GUI, like colorizing actions applied on connections (deny: red, allow: green) or the state of the rules (Enabled: green, Disabled: red):\n\n - commonDelegateConfig - Events view\n - defaultFWDelegateConfig - System firewall rules view\n - defaultRulesDelegateConfig - Application rules view\n - netstatDelegateConfig - Netstat view\n\n
These configurations are defined here: https://github.com/evilsocket/opensnitch/tree/master/ui/opensnitch/actions/default_actions.py\n\nIn order to customize the default configurations, copy the json to `/home//.config/opensnitch/actions/.json` and add your customizations.\n\n**Important:** Don't change the name field (`\"name\": \"commonDelegateConfig\",`).\n\nIn this example we'll colorize connections blocked by the rule `block-domains` in purple, and connections to the port 443 in darkRed:\n\n```json\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n```\n\n
\n Example: commonActionsDelegate.json\n\n```json\n{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. The name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\",\n \"LISTEN\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"Established\"\n ],\n \"cols\": [1],\n \"color\": \"blue\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n```\n
\n\n## Configuration\n\nFormat:\n \n```json\n \"highlight\": {\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ]\n \"rows\":[\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkgray\"\n }\n ]\n }\n```\n\n cells: rules will be applied only on individual cells.\\\n rows: rules will be applied to rows on the given columns.\n\n Fields:\n text: will match any of the given texts (the comparison is an OR operation).\n cols: look for patterns on these columns. The columns start at 0.\n color: colorizes the color of the text.\n bgcolor: colorizes the background color of the cell.\n alignment: cell's text alignment (values: hcenter, vcenter, center).\n\n Color names: https://doc.qt.io/qt-6/qcolor.html#predefined-colors\n\n Notes:\n - There're 3 default configurations that are applied on the views:\n commonDelegateConfig, defaultRulesDelegateConfig and\n defaultFWDelegateConfig\n\n Creating/Copying these configurations under\n XDG_CONFIG_HOME/.config/opensnitch/actions/ allows to overwrite and hence\n personalize the views highlighting colors.\n \n - The columns in the field \"cols\" start at 0.\n\n - The order of the customizations are applied from top to bottom, meaning that\n the last \"rule\" of the \"cells\" or \"rows\" arrays will override previous\n rules if there're conflicts. For example:\n\n [Rules tab]\n Action | Name | Enabled | ...\n drop | allow-always-telnet | False | ...\n\n","ui/opensnitch/plugins/versionchecker/versionchecker.json":"{\n \"name\": \"versionchecker\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"\",\n \"type\": [\"global\"],\n \"actions\": {\n \"versionchecker\": {\n \"enabled\": true,\n \"config\": {\n \"check_on_start\": false,\n \"name\": \"check-latest-release\",\n \"interval\": \"12\",\n \"units\": \"hours\",\n \"url\": \"https://api.github.com/repos/evilsocket/opensnitch/releases\"\n }\n }\n }\n}\n","ui/opensnitch/plugins/highlight/example/commonActionsDelegate.json":"{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"-> 53\"\n ],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"yellow\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"-> 443\"\n ],\n \"cols\": [3],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [8],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n","ui/opensnitch/plugins/highlight/example/rulesActionsDelegate.json":"{\n \"name\": \"defaultRulesDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize rules list. The name of this action MUST be defaultRulesDelegateConfig for now.\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"drop\", \"deny\", \"False\"],\n \"cols\": [3, 4],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"reject\"],\n \"cols\": [3, 4],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ],\n \"rows\": [\n {\n \"text\": [\"allow\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"green\"\n },\n {\n \"text\": [\"drop\", \"deny\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"crimson\"\n },\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkGray\"\n }\n ]\n }\n }\n}\n","ui/opensnitch/plugins/list_subscriptions/example/hagezi-light.txt.meta.json":"{\n \"version\": 1,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n\n \"etag\": \"\\\"abc123\\\"\",\n \"last_modified\": \"Sun, 01 Mar 2026 08:40:00 GMT\",\n\n \"last_checked\": \"2026-03-01T12:00:00+01:00\",\n \"last_updated\": \"2026-03-01T12:00:02+01:00\",\n\n \"last_result\": \"updated\",\n \"last_error\": \"\",\n\n \"fail_count\": 0,\n \"backoff_until\": \"\",\n\n \"bytes\": 1234567\n}\n","ui/opensnitch/plugins/list_subscriptions/example/list_subscriptions.json":"{\n \"name\": \"listSubscriptionsActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"Manage and auto-update blocklist subscriptions (hosts format)\",\n \"type\": [\"global\", \"main-dialog\"],\n \"actions\": {\n \"list_subscriptions\": {\n \"enabled\": true,\n \"config\": {\n \"lists_dir\": \"~/.config/opensnitch/list_subscriptions\",\n\n \"interval\": 24,\n \"interval_units\": \"hours\",\n\n \"timeout\": 20,\n \"timeout_units\": \"seconds\",\n\n \"max_size\": 50,\n \"max_size_units\": \"MB\",\n\n \"subscriptions\": [\n {\n \"name\": \"HaGeZi Light Hosts\",\n \"enabled\": true,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n \"filename\": \"hagezi-light.txt\",\n\n \"interval\": 12,\n \"interval_units\": \"hours\"\n }\n ],\n\n \"notify\": {\n \"success\": {\n \"desktop\": \"Lists subscriptions updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating lists subscriptions\"\n }\n }\n }\n }\n }\n}\n","ui/opensnitch/plugins/virustotal/example/virustotal.json":"{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections with Virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"https://virustotal.readme.io/docs/please-give-me-an-api-key\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"domains\", \"ips\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": false,\n \"use-reputation\": false,\n \"use-suspicious\": false\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [],\n \"domains\": []\n }\n }\n }\n}\n"},"files":{"ui/opensnitch/plugins/virustotal/README.md":"## VirusTotal plugin\n\nThis is a simple plugin that analyzes new outbound connections with virustotal:\n\n\"9-vt-1\"\n\n\n
It also obtains information about domains in the Hosts tab:\n\n\"hosts-vt\"\n\n\n
and adds a tab to the process dialog, which obtains information about the process if the hash was submitted to virustotal.\n\n\"8-vt-1\"\n\n\n
**Privacy warning:** remember that the domains, IPs or hashes will be sent to the servers of virustotal.\n\n## Prerequisites\n\nGet an API key: https://virustotal.readme.io/docs/please-give-me-an-api-key\n\n## Configuration\n\nFirstly add a new rule to allow connections from the GUI to www.virustotal.com:\n\n```json\n{\n \"created\": \"2023-02-19T20:44:36.000000Z\",\n \"name\": \"allow-virustotal\",\n \"enabled\": true,\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"type\": \"list\",\n \"operand\": \"list\",\n \"list\": [\n {\n \"type\": \"simple\",\n \"operand\": \"dest.port\",\n \"data\": \"443\"\n },\n {\n \"type\": \"simple\",\n \"operand\": \"dest.host\",\n \"data\": \"www.virustotal.com\"\n }\n ]\n }\n}\n```\n\nSecondly, create the plugin configuration under `/home//.config/opensnitch/actions/virustotal.json`:\n\n```json\n{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections properties with virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"ips\", \"domains\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": true,\n \"use-reputation\": true,\n \"use-suspicious\": true\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [\"127.\", \"192.168.\"],\n \"domains\": [\".lan\"]\n }\n }\n }\n}\n```\n\n|item|value|\n|----|-----|\n|config.api_timeout|maximum allowed time in seconds to obtain a response from the server. 1 is usually too low. 2 or 3 usually works fine.|\n|config.api_quota| Maximum allowed requests. If we exceed this value, we won't try to analyze new connections (they'll be denied anyway). The free account has a limit of 500. If you use a different license, adjust this value accordingly.|\n|malicious.icon|Change the icon of the popup if the connection is flagged as malicious. Leave empty to skip it. The name of the icon depends on the icon theme of your Desktop Environment|\n|malicious.minimum-threshold|The minimum malicious score used to consider an outbound connection potentially malicious.|\n|malicious.use-community-score|Users can vote to flag something as malicious or not (IP, domain, hash, etc).|\n|malicious.use-reputation||\n|exclusions.ips|IPs to exclude from being analyzed. By default private IPs are already excluded. The exclusion will take effect if the IP contains the exclusion|\n|exclusions.domains|Domains to exclude from being analyzed. The exclusion will take effect if the domain contains the exclusion (for example: www.github.com.lan)|\n\n#### API Documentation: \n\n - https://developers.virustotal.com/reference/domain-info\n - https://developers.virustotal.com/reference/domains-1\n - https://developers.virustotal.com/reference/ip-info\n - https://docs.virustotal.com/reference/ip-object\n - https://developers.virustotal.com/reference/file-info\n - https://docs.virustotal.com/reference/files\n","daemon/data/rules/000-allow-localhost6.json":"{\n \"created\": \"2025-04-09T23:17:39-06:00\",\n \"updated\": \"2025-04-09T23:17:39-06:00\",\n \"name\": \"000-allow-localhost6\",\n \"description\": \"Allow connections to localhost. More information:\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"::1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","ui/opensnitch/plugins/downloader/example/downloaders.json":"{\n \"name\": \"downloadersActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"download ads/malware lists, save them to a local directory, and create a rule to filter by lists in that directory\",\n \"type\": [\"global\"],\n \"actions\": {\n \"downloader\": {\n \"enabled\": true,\n \"config\": [\n {\n \"name\": \"update ads lists\",\n \"interval\": \"6\",\n \"units\": \"hours\",\n \"urls\": [\n {\n \"name\": \"adaway\",\n \"enabled\": true,\n \"remote\": \"https://adaway.org/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-adaway-hosts.txt\"\n },\n {\n \"name\": \"developerdan\",\n \"enabled\": true,\n \"remote\": \"https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt\",\n \"localfile\": \"/tmp/blocklist/ads-tracking-aggressive-extended.txt\"\n },\n {\n \"name\": \"1hosts\",\n \"enabled\": true,\n \"remote\": \"https://raw.githubusercontent.com/badmojr/1Hosts/master/Pro/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-1hosts.txt\"\n },\n {\n \"name\": \"frogeye multipary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-multiparty.txt\"\n },\n {\n \"name\": \"frogeye firstpary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-firstparty.txt\"\n },\n {\n \"name\": \"urlhaus\",\n \"enabled\": true,\n \"remote\": \"https://urlhaus.abuse.ch/downloads/hostfile/\",\n \"localfile\": \"/tmp/blocklist/urlhaus-hosts.txt\"\n },\n {\n \"name\": \"pgl.yoyo.org\",\n \"enabled\": true,\n \"remote\": \"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext\",\n \"localfile\": \"/tmp/blocklist/pgl.yoyo.txt\"\n }\n ],\n \"notify\": {\n \"success\": {\n \"desktop\": \"Blocklists updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating blocklists\"\n }\n }\n } \n ]\n }\n }\n}\n","daemon/data/rules/000-allow-localhost.json":"{\n \"created\": \"2025-04-09T23:21:35-06:00\",\n \"updated\": \"2025-04-09T23:21:35-06:00\",\n \"name\": \"000-allow-localhost\",\n \"description\": \"Allow connections to localhost. More information:\\n\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"127.0.0.1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","ui/opensnitch/plugins/highlight/README.md":"## Highlight plugin\n\nA plugin to colorize rows or cells of the GUI based on patterns.\n\n\"Captura\n\n
There're 4 built-in configurations, used to highlight parts of the GUI, like colorizing actions applied on connections (deny: red, allow: green) or the state of the rules (Enabled: green, Disabled: red):\n\n - commonDelegateConfig - Events view\n - defaultFWDelegateConfig - System firewall rules view\n - defaultRulesDelegateConfig - Application rules view\n - netstatDelegateConfig - Netstat view\n\n
These configurations are defined here: https://github.com/evilsocket/opensnitch/tree/master/ui/opensnitch/actions/default_actions.py\n\nIn order to customize the default configurations, copy the json to `/home//.config/opensnitch/actions/.json` and add your customizations.\n\n**Important:** Don't change the name field (`\"name\": \"commonDelegateConfig\",`).\n\nIn this example we'll colorize connections blocked by the rule `block-domains` in purple, and connections to the port 443 in darkRed:\n\n```json\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n```\n\n
\n Example: commonActionsDelegate.json\n\n```json\n{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. The name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\",\n \"LISTEN\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"Established\"\n ],\n \"cols\": [1],\n \"color\": \"blue\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n```\n
\n\n## Configuration\n\nFormat:\n \n```json\n \"highlight\": {\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ]\n \"rows\":[\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkgray\"\n }\n ]\n }\n```\n\n cells: rules will be applied only on individual cells.\\\n rows: rules will be applied to rows on the given columns.\n\n Fields:\n text: will match any of the given texts (the comparison is an OR operation).\n cols: look for patterns on these columns. The columns start at 0.\n color: colorizes the color of the text.\n bgcolor: colorizes the background color of the cell.\n alignment: cell's text alignment (values: hcenter, vcenter, center).\n\n Color names: https://doc.qt.io/qt-6/qcolor.html#predefined-colors\n\n Notes:\n - There're 3 default configurations that are applied on the views:\n commonDelegateConfig, defaultRulesDelegateConfig and\n defaultFWDelegateConfig\n\n Creating/Copying these configurations under\n XDG_CONFIG_HOME/.config/opensnitch/actions/ allows to overwrite and hence\n personalize the views highlighting colors.\n \n - The columns in the field \"cols\" start at 0.\n\n - The order of the customizations are applied from top to bottom, meaning that\n the last \"rule\" of the \"cells\" or \"rows\" arrays will override previous\n rules if there're conflicts. For example:\n\n [Rules tab]\n Action | Name | Enabled | ...\n drop | allow-always-telnet | False | ...\n\n","ui/opensnitch/plugins/versionchecker/versionchecker.json":"{\n \"name\": \"versionchecker\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"\",\n \"type\": [\"global\"],\n \"actions\": {\n \"versionchecker\": {\n \"enabled\": true,\n \"config\": {\n \"check_on_start\": false,\n \"name\": \"check-latest-release\",\n \"interval\": \"12\",\n \"units\": \"hours\",\n \"url\": \"https://api.github.com/repos/evilsocket/opensnitch/releases\"\n }\n }\n }\n}\n","ui/opensnitch/plugins/highlight/example/commonActionsDelegate.json":"{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"-> 53\"\n ],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"yellow\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"-> 443\"\n ],\n \"cols\": [3],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [8],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n","ui/opensnitch/plugins/highlight/example/rulesActionsDelegate.json":"{\n \"name\": \"defaultRulesDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize rules list. The name of this action MUST be defaultRulesDelegateConfig for now.\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"drop\", \"deny\", \"False\"],\n \"cols\": [3, 4],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"reject\"],\n \"cols\": [3, 4],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ],\n \"rows\": [\n {\n \"text\": [\"allow\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"green\"\n },\n {\n \"text\": [\"drop\", \"deny\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"crimson\"\n },\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkGray\"\n }\n ]\n }\n }\n}\n","ui/opensnitch/plugins/list_subscriptions/example/hagezi-light.txt.meta.json":"{\n \"version\": 1,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n\n \"etag\": \"\\\"abc123\\\"\",\n \"last_modified\": \"Sun, 01 Mar 2026 08:40:00 GMT\",\n\n \"last_checked\": \"2026-03-01T12:00:00+01:00\",\n \"last_updated\": \"2026-03-01T12:00:02+01:00\",\n\n \"last_result\": \"updated\",\n \"last_error\": \"\",\n\n \"fail_count\": 0,\n \"backoff_until\": \"\",\n\n \"bytes\": 1234567\n}\n","ui/opensnitch/plugins/list_subscriptions/example/list_subscriptions.json":"{\n \"name\": \"listSubscriptionsActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"Manage and auto-update blocklist subscriptions (hosts format)\",\n \"type\": [\"global\", \"main-dialog\"],\n \"actions\": {\n \"list_subscriptions\": {\n \"enabled\": true,\n \"config\": {\n \"lists_dir\": \"~/.config/opensnitch/list_subscriptions\",\n\n \"interval\": 24,\n \"interval_units\": \"hours\",\n\n \"timeout\": 20,\n \"timeout_units\": \"seconds\",\n\n \"max_size\": 50,\n \"max_size_units\": \"MB\",\n\n \"subscriptions\": [\n {\n \"name\": \"HaGeZi Light Hosts\",\n \"enabled\": true,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n \"filename\": \"hagezi-light.txt\",\n\n \"interval\": 12,\n \"interval_units\": \"hours\"\n }\n ],\n\n \"notify\": {\n \"success\": {\n \"desktop\": \"Lists subscriptions updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating lists subscriptions\"\n }\n }\n }\n }\n }\n}\n","ui/opensnitch/plugins/virustotal/example/virustotal.json":"{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections with Virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"https://virustotal.readme.io/docs/please-give-me-an-api-key\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"domains\", \"ips\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": false,\n \"use-reputation\": false,\n \"use-suspicious\": false\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [],\n \"domains\": []\n }\n }\n }\n}\n"},"items":[{"name":"000-allow-localhost.json","path":"daemon/data/rules/000-allow-localhost.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/daemon/data/rules/000-allow-localhost.json","title":"000-allow-localhost","category":"anthropic-skill","format":"json","content":"{\n \"created\": \"2025-04-09T23:21:35-06:00\",\n \"updated\": \"2025-04-09T23:21:35-06:00\",\n \"name\": \"000-allow-localhost\",\n \"description\": \"Allow connections to localhost. More information:\\n\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"127.0.0.1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","frontmatter":{"created":"2025-04-09T23:21:35-06:00","updated":"2025-04-09T23:21:35-06:00","name":"000-allow-localhost","description":"Allow connections to localhost. More information:\n\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections","action":"allow","duration":"always","operator":{"operand":"dest.ip","data":"127.0.0.1","type":"simple","list":[],"sensitive":false},"enabled":true,"precedence":true,"nolog":true},"isInternal":false,"tokens":172,"sizeBytes":503},{"name":"000-allow-localhost6.json","path":"daemon/data/rules/000-allow-localhost6.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/daemon/data/rules/000-allow-localhost6.json","title":"000-allow-localhost6","category":"anthropic-skill","format":"json","content":"{\n \"created\": \"2025-04-09T23:17:39-06:00\",\n \"updated\": \"2025-04-09T23:17:39-06:00\",\n \"name\": \"000-allow-localhost6\",\n \"description\": \"Allow connections to localhost. More information:\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"::1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n","frontmatter":{"created":"2025-04-09T23:17:39-06:00","updated":"2025-04-09T23:17:39-06:00","name":"000-allow-localhost6","description":"Allow connections to localhost. More information:\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections","action":"allow","duration":"always","operator":{"operand":"dest.ip","data":"::1","type":"simple","list":[],"sensitive":false},"enabled":true,"precedence":true,"nolog":true},"isInternal":false,"tokens":166,"sizeBytes":496},{"name":"downloaders.json","path":"ui/opensnitch/plugins/downloader/example/downloaders.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/downloader/example/downloaders.json","title":"downloadersActions","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"downloadersActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"download ads/malware lists, save them to a local directory, and create a rule to filter by lists in that directory\",\n \"type\": [\"global\"],\n \"actions\": {\n \"downloader\": {\n \"enabled\": true,\n \"config\": [\n {\n \"name\": \"update ads lists\",\n \"interval\": \"6\",\n \"units\": \"hours\",\n \"urls\": [\n {\n \"name\": \"adaway\",\n \"enabled\": true,\n \"remote\": \"https://adaway.org/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-adaway-hosts.txt\"\n },\n {\n \"name\": \"developerdan\",\n \"enabled\": true,\n \"remote\": \"https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt\",\n \"localfile\": \"/tmp/blocklist/ads-tracking-aggressive-extended.txt\"\n },\n {\n \"name\": \"1hosts\",\n \"enabled\": true,\n \"remote\": \"https://raw.githubusercontent.com/badmojr/1Hosts/master/Pro/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-1hosts.txt\"\n },\n {\n \"name\": \"frogeye multipary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-multiparty.txt\"\n },\n {\n \"name\": \"frogeye firstpary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-firstparty.txt\"\n },\n {\n \"name\": \"urlhaus\",\n \"enabled\": true,\n \"remote\": \"https://urlhaus.abuse.ch/downloads/hostfile/\",\n \"localfile\": \"/tmp/blocklist/urlhaus-hosts.txt\"\n },\n {\n \"name\": \"pgl.yoyo.org\",\n \"enabled\": true,\n \"remote\": \"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext\",\n \"localfile\": \"/tmp/blocklist/pgl.yoyo.txt\"\n }\n ],\n \"notify\": {\n \"success\": {\n \"desktop\": \"Blocklists updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating blocklists\"\n }\n }\n } \n ]\n }\n }\n}\n","frontmatter":{"name":"downloadersActions","created":"","updated":"","description":"download ads/malware lists, save them to a local directory, and create a rule to filter by lists in that directory","type":["global"],"actions":{"downloader":{"enabled":true,"config":[{"name":"update ads lists","interval":"6","units":"hours","urls":[{"name":"adaway","enabled":true,"remote":"https://adaway.org/hosts.txt","localfile":"/tmp/blocklist/ads-adaway-hosts.txt"},{"name":"developerdan","enabled":true,"remote":"https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt","localfile":"/tmp/blocklist/ads-tracking-aggressive-extended.txt"},{"name":"1hosts","enabled":true,"remote":"https://raw.githubusercontent.com/badmojr/1Hosts/master/Pro/hosts.txt","localfile":"/tmp/blocklist/ads-1hosts.txt"},{"name":"frogeye multipary","enabled":true,"remote":"https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt","localfile":"/tmp/blocklist/frog-multiparty.txt"},{"name":"frogeye firstpary","enabled":true,"remote":"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt","localfile":"/tmp/blocklist/frog-firstparty.txt"},{"name":"urlhaus","enabled":true,"remote":"https://urlhaus.abuse.ch/downloads/hostfile/","localfile":"/tmp/blocklist/urlhaus-hosts.txt"},{"name":"pgl.yoyo.org","enabled":true,"remote":"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext","localfile":"/tmp/blocklist/pgl.yoyo.txt"}],"notify":{"success":{"desktop":"Blocklists updated"},"error":{"desktop":"Error updating blocklists"}}}]}}},"isInternal":false,"tokens":572,"sizeBytes":3058},{"name":"commonActionsDelegate.json","path":"ui/opensnitch/plugins/highlight/example/commonActionsDelegate.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/highlight/example/commonActionsDelegate.json","title":"commonDelegateConfig","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"-> 53\"\n ],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"yellow\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"-> 443\"\n ],\n \"cols\": [3],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [8],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n","frontmatter":{"name":"commonDelegateConfig","created":"","updated":"","description":"customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now","actions":{"Highlight":{"enabled":true,"cells":[{"text":["allow","✓ online"],"cols":[1,2,3],"color":"green","bgcolor":"","alignment":["center"]},{"text":["drop","deny","☓ offline"],"cols":[1,2,3],"color":"red","bgcolor":"","alignment":["center"]},{"text":["reject"],"cols":[1,2,3],"color":"purple","bgcolor":"","alignment":["center"]}],"rows":[{"text":["-> 53"],"cols":[3],"color":"black","bgcolor":"yellow","alignment":[]},{"text":["-> 443"],"cols":[3],"color":"white","bgcolor":"darkRed","alignment":[]},{"text":["block-domains"],"cols":[8],"color":"white","bgcolor":"darkMagenta","alignment":[]}]}}},"isInternal":false,"tokens":379,"sizeBytes":1575},{"name":"rulesActionsDelegate.json","path":"ui/opensnitch/plugins/highlight/example/rulesActionsDelegate.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/highlight/example/rulesActionsDelegate.json","title":"defaultRulesDelegateConfig","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"defaultRulesDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize rules list. The name of this action MUST be defaultRulesDelegateConfig for now.\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"drop\", \"deny\", \"False\"],\n \"cols\": [3, 4],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"reject\"],\n \"cols\": [3, 4],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ],\n \"rows\": [\n {\n \"text\": [\"allow\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"green\"\n },\n {\n \"text\": [\"drop\", \"deny\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"crimson\"\n },\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkGray\"\n }\n ]\n }\n }\n}\n","frontmatter":{"name":"defaultRulesDelegateConfig","created":"","updated":"","description":"customize rules list. The name of this action MUST be defaultRulesDelegateConfig for now.","actions":{"Highlight":{"enabled":true,"cells":[{"text":["allow","True"],"cols":[3,4],"color":"green","bgcolor":"","alignment":["center"]},{"text":["drop","deny","False"],"cols":[3,4],"color":"red","bgcolor":"","alignment":["center"]},{"text":["reject"],"cols":[3,4],"color":"purple","bgcolor":"","alignment":["center"]}],"rows":[{"text":["allow"],"cols":[4],"color":"white","bgcolor":"green"},{"text":["drop","deny"],"cols":[4],"color":"white","bgcolor":"crimson"},{"text":["False"],"cols":[3],"color":"black","bgcolor":"darkGray"}]}}},"isInternal":false,"tokens":309,"sizeBytes":1280},{"name":"hagezi-light.txt.meta.json","path":"ui/opensnitch/plugins/list_subscriptions/example/hagezi-light.txt.meta.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/list_subscriptions/example/hagezi-light.txt.meta.json","title":"Example Skill","category":"anthropic-skill","format":"json","content":"{\n \"version\": 1,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n\n \"etag\": \"\\\"abc123\\\"\",\n \"last_modified\": \"Sun, 01 Mar 2026 08:40:00 GMT\",\n\n \"last_checked\": \"2026-03-01T12:00:00+01:00\",\n \"last_updated\": \"2026-03-01T12:00:02+01:00\",\n\n \"last_result\": \"updated\",\n \"last_error\": \"\",\n\n \"fail_count\": 0,\n \"backoff_until\": \"\",\n\n \"bytes\": 1234567\n}\n","frontmatter":{"version":1,"url":"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt","format":"hosts","etag":"\"abc123\"","last_modified":"Sun, 01 Mar 2026 08:40:00 GMT","last_checked":"2026-03-01T12:00:00+01:00","last_updated":"2026-03-01T12:00:02+01:00","last_result":"updated","last_error":"","fail_count":0,"backoff_until":"","bytes":1234567},"isInternal":false,"tokens":158,"sizeBytes":410},{"name":"list_subscriptions.json","path":"ui/opensnitch/plugins/list_subscriptions/example/list_subscriptions.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/list_subscriptions/example/list_subscriptions.json","title":"listSubscriptionsActions","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"listSubscriptionsActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"Manage and auto-update blocklist subscriptions (hosts format)\",\n \"type\": [\"global\", \"main-dialog\"],\n \"actions\": {\n \"list_subscriptions\": {\n \"enabled\": true,\n \"config\": {\n \"lists_dir\": \"~/.config/opensnitch/list_subscriptions\",\n\n \"interval\": 24,\n \"interval_units\": \"hours\",\n\n \"timeout\": 20,\n \"timeout_units\": \"seconds\",\n\n \"max_size\": 50,\n \"max_size_units\": \"MB\",\n\n \"subscriptions\": [\n {\n \"name\": \"HaGeZi Light Hosts\",\n \"enabled\": true,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n \"filename\": \"hagezi-light.txt\",\n\n \"interval\": 12,\n \"interval_units\": \"hours\"\n }\n ],\n\n \"notify\": {\n \"success\": {\n \"desktop\": \"Lists subscriptions updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating lists subscriptions\"\n }\n }\n }\n }\n }\n}\n","frontmatter":{"name":"listSubscriptionsActions","created":"","updated":"","description":"Manage and auto-update blocklist subscriptions (hosts format)","type":["global","main-dialog"],"actions":{"list_subscriptions":{"enabled":true,"config":{"lists_dir":"~/.config/opensnitch/list_subscriptions","interval":24,"interval_units":"hours","timeout":20,"timeout_units":"seconds","max_size":50,"max_size_units":"MB","subscriptions":[{"name":"HaGeZi Light Hosts","enabled":true,"url":"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt","format":"hosts","filename":"hagezi-light.txt","interval":12,"interval_units":"hours"}],"notify":{"success":{"desktop":"Lists subscriptions updated"},"error":{"desktop":"Error updating lists subscriptions"}}}}}},"isInternal":false,"tokens":270,"sizeBytes":1138},{"name":"versionchecker.json","path":"ui/opensnitch/plugins/versionchecker/versionchecker.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/versionchecker/versionchecker.json","title":"versionchecker","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"versionchecker\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"\",\n \"type\": [\"global\"],\n \"actions\": {\n \"versionchecker\": {\n \"enabled\": true,\n \"config\": {\n \"check_on_start\": false,\n \"name\": \"check-latest-release\",\n \"interval\": \"12\",\n \"units\": \"hours\",\n \"url\": \"https://api.github.com/repos/evilsocket/opensnitch/releases\"\n }\n }\n }\n}\n","frontmatter":{"name":"versionchecker","created":"","updated":"","description":"","type":["global"],"actions":{"versionchecker":{"enabled":true,"config":{"check_on_start":false,"name":"check-latest-release","interval":"12","units":"hours","url":"https://api.github.com/repos/evilsocket/opensnitch/releases"}}}},"isInternal":false,"tokens":112,"sizeBytes":455},{"name":"virustotal.json","path":"ui/opensnitch/plugins/virustotal/example/virustotal.json","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/virustotal/example/virustotal.json","title":"virustotal","category":"anthropic-skill","format":"json","content":"{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections with Virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"https://virustotal.readme.io/docs/please-give-me-an-api-key\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"domains\", \"ips\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": false,\n \"use-reputation\": false,\n \"use-suspicious\": false\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [],\n \"domains\": []\n }\n }\n }\n}\n","frontmatter":{"name":"virustotal","created":"","updated":"","description":"analyze connections with Virustotal","type":["popups","proc-dialog","main-dialog"],"actions":{"virustotal":{"enabled":true,"loglevel":"debug","config":{"api_timeout":2,"api_quota":500,"api_key":"https://virustotal.readme.io/docs/please-give-me-an-api-key","api_domains_url":"https://www.virustotal.com/api/v3/domains/","api_ips_url":"https://www.virustotal.com/api/v3/ip_addresses/","api_files_url":"https://www.virustotal.com/api/v3/files/"},"check":["domains","ips","hashes"],"malicious":{"minimum-threshold":1,"action":"reject","icon":"dialog-warning","use-community-score":false,"use-reputation":false,"use-suspicious":false},"widgets-colors":{"malicious":"red","benign":"green","unknown":"darkOrange"},"exclusions":{"ips":[],"domains":[]}}}},"isInternal":false,"tokens":310,"sizeBytes":1256},{"name":"README.md","path":"ui/opensnitch/plugins/highlight/README.md","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/highlight/README.md","title":"highlight Documentation","category":"plugin-manifest","format":"markdown","content":"## Highlight plugin\n\nA plugin to colorize rows or cells of the GUI based on patterns.\n\n\"Captura\n\n
There're 4 built-in configurations, used to highlight parts of the GUI, like colorizing actions applied on connections (deny: red, allow: green) or the state of the rules (Enabled: green, Disabled: red):\n\n - commonDelegateConfig - Events view\n - defaultFWDelegateConfig - System firewall rules view\n - defaultRulesDelegateConfig - Application rules view\n - netstatDelegateConfig - Netstat view\n\n
These configurations are defined here: https://github.com/evilsocket/opensnitch/tree/master/ui/opensnitch/actions/default_actions.py\n\nIn order to customize the default configurations, copy the json to `/home//.config/opensnitch/actions/.json` and add your customizations.\n\n**Important:** Don't change the name field (`\"name\": \"commonDelegateConfig\",`).\n\nIn this example we'll colorize connections blocked by the rule `block-domains` in purple, and connections to the port 443 in darkRed:\n\n```json\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n```\n\n
\n Example: commonActionsDelegate.json\n\n```json\n{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. The name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\",\n \"LISTEN\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"Established\"\n ],\n \"cols\": [1],\n \"color\": \"blue\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n```\n
\n\n## Configuration\n\nFormat:\n \n```json\n \"highlight\": {\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ]\n \"rows\":[\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkgray\"\n }\n ]\n }\n```\n\n cells: rules will be applied only on individual cells.\\\n rows: rules will be applied to rows on the given columns.\n\n Fields:\n text: will match any of the given texts (the comparison is an OR operation).\n cols: look for patterns on these columns. The columns start at 0.\n color: colorizes the color of the text.\n bgcolor: colorizes the background color of the cell.\n alignment: cell's text alignment (values: hcenter, vcenter, center).\n\n Color names: https://doc.qt.io/qt-6/qcolor.html#predefined-colors\n\n Notes:\n - There're 3 default configurations that are applied on the views:\n commonDelegateConfig, defaultRulesDelegateConfig and\n defaultFWDelegateConfig\n\n Creating/Copying these configurations under\n XDG_CONFIG_HOME/.config/opensnitch/actions/ allows to overwrite and hence\n personalize the views highlighting colors.\n \n - The columns in the field \"cols\" start at 0.\n\n - The order of the customizations are applied from top to bottom, meaning that\n the last \"rule\" of the \"cells\" or \"rows\" arrays will override previous\n rules if there're conflicts. For example:\n\n [Rules tab]\n Action | Name | Enabled | ...\n drop | allow-always-telnet | False | ...\n\n","isInternal":false,"tokens":1194,"sizeBytes":4989},{"name":"README.md","path":"ui/opensnitch/plugins/virustotal/README.md","rawUrl":"https://raw.githubusercontent.com/evilsocket/opensnitch/HEAD/ui/opensnitch/plugins/virustotal/README.md","title":"virustotal Documentation","category":"plugin-manifest","format":"markdown","content":"## VirusTotal plugin\n\nThis is a simple plugin that analyzes new outbound connections with virustotal:\n\n\"9-vt-1\"\n\n\n
It also obtains information about domains in the Hosts tab:\n\n\"hosts-vt\"\n\n\n
and adds a tab to the process dialog, which obtains information about the process if the hash was submitted to virustotal.\n\n\"8-vt-1\"\n\n\n
**Privacy warning:** remember that the domains, IPs or hashes will be sent to the servers of virustotal.\n\n## Prerequisites\n\nGet an API key: https://virustotal.readme.io/docs/please-give-me-an-api-key\n\n## Configuration\n\nFirstly add a new rule to allow connections from the GUI to www.virustotal.com:\n\n```json\n{\n \"created\": \"2023-02-19T20:44:36.000000Z\",\n \"name\": \"allow-virustotal\",\n \"enabled\": true,\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"type\": \"list\",\n \"operand\": \"list\",\n \"list\": [\n {\n \"type\": \"simple\",\n \"operand\": \"dest.port\",\n \"data\": \"443\"\n },\n {\n \"type\": \"simple\",\n \"operand\": \"dest.host\",\n \"data\": \"www.virustotal.com\"\n }\n ]\n }\n}\n```\n\nSecondly, create the plugin configuration under `/home//.config/opensnitch/actions/virustotal.json`:\n\n```json\n{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections properties with virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"ips\", \"domains\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": true,\n \"use-reputation\": true,\n \"use-suspicious\": true\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [\"127.\", \"192.168.\"],\n \"domains\": [\".lan\"]\n }\n }\n }\n}\n```\n\n|item|value|\n|----|-----|\n|config.api_timeout|maximum allowed time in seconds to obtain a response from the server. 1 is usually too low. 2 or 3 usually works fine.|\n|config.api_quota| Maximum allowed requests. If we exceed this value, we won't try to analyze new connections (they'll be denied anyway). The free account has a limit of 500. If you use a different license, adjust this value accordingly.|\n|malicious.icon|Change the icon of the popup if the connection is flagged as malicious. Leave empty to skip it. The name of the icon depends on the icon theme of your Desktop Environment|\n|malicious.minimum-threshold|The minimum malicious score used to consider an outbound connection potentially malicious.|\n|malicious.use-community-score|Users can vote to flag something as malicious or not (IP, domain, hash, etc).|\n|malicious.use-reputation||\n|exclusions.ips|IPs to exclude from being analyzed. By default private IPs are already excluded. The exclusion will take effect if the IP contains the exclusion|\n|exclusions.domains|Domains to exclude from being analyzed. The exclusion will take effect if the domain contains the exclusion (for example: www.github.com.lan)|\n\n#### API Documentation: \n\n - https://developers.virustotal.com/reference/domain-info\n - https://developers.virustotal.com/reference/domains-1\n - https://developers.virustotal.com/reference/ip-info\n - https://docs.virustotal.com/reference/ip-object\n - https://developers.virustotal.com/reference/file-info\n - https://docs.virustotal.com/reference/files\n","isInternal":false,"tokens":1130,"sizeBytes":4542}],"systemPromptSnippet":"\n\n{\n \"created\": \"2025-04-09T23:21:35-06:00\",\n \"updated\": \"2025-04-09T23:21:35-06:00\",\n \"name\": \"000-allow-localhost\",\n \"description\": \"Allow connections to localhost. More information:\\n\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"127.0.0.1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n\n\n{\n \"created\": \"2025-04-09T23:17:39-06:00\",\n \"updated\": \"2025-04-09T23:17:39-06:00\",\n \"name\": \"000-allow-localhost6\",\n \"description\": \"Allow connections to localhost. More information:\\nhttps://github.com/evilsocket/opensnitch/wiki/Rules#localhost-connections\",\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"operand\": \"dest.ip\",\n \"data\": \"::1\",\n \"type\": \"simple\",\n \"list\": [],\n \"sensitive\": false\n },\n \"enabled\": true,\n \"precedence\": true,\n \"nolog\": true\n}\n\n\n{\n \"name\": \"downloadersActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"download ads/malware lists, save them to a local directory, and create a rule to filter by lists in that directory\",\n \"type\": [\"global\"],\n \"actions\": {\n \"downloader\": {\n \"enabled\": true,\n \"config\": [\n {\n \"name\": \"update ads lists\",\n \"interval\": \"6\",\n \"units\": \"hours\",\n \"urls\": [\n {\n \"name\": \"adaway\",\n \"enabled\": true,\n \"remote\": \"https://adaway.org/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-adaway-hosts.txt\"\n },\n {\n \"name\": \"developerdan\",\n \"enabled\": true,\n \"remote\": \"https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt\",\n \"localfile\": \"/tmp/blocklist/ads-tracking-aggressive-extended.txt\"\n },\n {\n \"name\": \"1hosts\",\n \"enabled\": true,\n \"remote\": \"https://raw.githubusercontent.com/badmojr/1Hosts/master/Pro/hosts.txt\",\n \"localfile\": \"/tmp/blocklist/ads-1hosts.txt\"\n },\n {\n \"name\": \"frogeye multipary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-multiparty.txt\"\n },\n {\n \"name\": \"frogeye firstpary\",\n \"enabled\": true,\n \"remote\": \"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt\",\n \"localfile\": \"/tmp/blocklist/frog-firstparty.txt\"\n },\n {\n \"name\": \"urlhaus\",\n \"enabled\": true,\n \"remote\": \"https://urlhaus.abuse.ch/downloads/hostfile/\",\n \"localfile\": \"/tmp/blocklist/urlhaus-hosts.txt\"\n },\n {\n \"name\": \"pgl.yoyo.org\",\n \"enabled\": true,\n \"remote\": \"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext\",\n \"localfile\": \"/tmp/blocklist/pgl.yoyo.txt\"\n }\n ],\n \"notify\": {\n \"success\": {\n \"desktop\": \"Blocklists updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating blocklists\"\n }\n }\n } \n ]\n }\n }\n}\n\n\n{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"-> 53\"\n ],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"yellow\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"-> 443\"\n ],\n \"cols\": [3],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [8],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n\n\n{\n \"name\": \"defaultRulesDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize rules list. The name of this action MUST be defaultRulesDelegateConfig for now.\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"drop\", \"deny\", \"False\"],\n \"cols\": [3, 4],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n },\n {\n \"text\": [\"reject\"],\n \"cols\": [3, 4],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ],\n \"rows\": [\n {\n \"text\": [\"allow\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"green\"\n },\n {\n \"text\": [\"drop\", \"deny\"],\n \"cols\": [4],\n \"color\": \"white\",\n \"bgcolor\": \"crimson\"\n },\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkGray\"\n }\n ]\n }\n }\n}\n\n\n{\n \"version\": 1,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n\n \"etag\": \"\\\"abc123\\\"\",\n \"last_modified\": \"Sun, 01 Mar 2026 08:40:00 GMT\",\n\n \"last_checked\": \"2026-03-01T12:00:00+01:00\",\n \"last_updated\": \"2026-03-01T12:00:02+01:00\",\n\n \"last_result\": \"updated\",\n \"last_error\": \"\",\n\n \"fail_count\": 0,\n \"backoff_until\": \"\",\n\n \"bytes\": 1234567\n}\n\n\n{\n \"name\": \"listSubscriptionsActions\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"Manage and auto-update blocklist subscriptions (hosts format)\",\n \"type\": [\"global\", \"main-dialog\"],\n \"actions\": {\n \"list_subscriptions\": {\n \"enabled\": true,\n \"config\": {\n \"lists_dir\": \"~/.config/opensnitch/list_subscriptions\",\n\n \"interval\": 24,\n \"interval_units\": \"hours\",\n\n \"timeout\": 20,\n \"timeout_units\": \"seconds\",\n\n \"max_size\": 50,\n \"max_size_units\": \"MB\",\n\n \"subscriptions\": [\n {\n \"name\": \"HaGeZi Light Hosts\",\n \"enabled\": true,\n \"url\": \"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt\",\n \"format\": \"hosts\",\n \"filename\": \"hagezi-light.txt\",\n\n \"interval\": 12,\n \"interval_units\": \"hours\"\n }\n ],\n\n \"notify\": {\n \"success\": {\n \"desktop\": \"Lists subscriptions updated\"\n },\n \"error\": {\n \"desktop\": \"Error updating lists subscriptions\"\n }\n }\n }\n }\n }\n}\n\n\n{\n \"name\": \"versionchecker\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"\",\n \"type\": [\"global\"],\n \"actions\": {\n \"versionchecker\": {\n \"enabled\": true,\n \"config\": {\n \"check_on_start\": false,\n \"name\": \"check-latest-release\",\n \"interval\": \"12\",\n \"units\": \"hours\",\n \"url\": \"https://api.github.com/repos/evilsocket/opensnitch/releases\"\n }\n }\n }\n}\n\n\n{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections with Virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"https://virustotal.readme.io/docs/please-give-me-an-api-key\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"domains\", \"ips\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": false,\n \"use-reputation\": false,\n \"use-suspicious\": false\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [],\n \"domains\": []\n }\n }\n }\n}\n\n\n## Highlight plugin\n\nA plugin to colorize rows or cells of the GUI based on patterns.\n\n\"Captura\n\n
There're 4 built-in configurations, used to highlight parts of the GUI, like colorizing actions applied on connections (deny: red, allow: green) or the state of the rules (Enabled: green, Disabled: red):\n\n - commonDelegateConfig - Events view\n - defaultFWDelegateConfig - System firewall rules view\n - defaultRulesDelegateConfig - Application rules view\n - netstatDelegateConfig - Netstat view\n\n
These configurations are defined here: https://github.com/evilsocket/opensnitch/tree/master/ui/opensnitch/actions/default_actions.py\n\nIn order to customize the default configurations, copy the json to `/home//.config/opensnitch/actions/.json` and add your customizations.\n\n**Important:** Don't change the name field (`\"name\": \"commonDelegateConfig\",`).\n\nIn this example we'll colorize connections blocked by the rule `block-domains` in purple, and connections to the port 443 in darkRed:\n\n```json\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n```\n\n
\n Example: commonActionsDelegate.json\n\n```json\n{\n \"name\": \"commonDelegateConfig\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"customize Events tab view colors. The name of this action MUST be commonDelegateConfig for now\",\n \"actions\": {\n \"Highlight\": {\n \"enabled\": true,\n \"cells\": [\n {\n \"text\": [\n \"allow\",\n \"✓ online\",\n \"LISTEN\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"drop\",\n \"deny\",\n \"☓ offline\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"red\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"reject\"\n ],\n \"cols\": [1, 2, 3],\n \"color\": \"purple\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n },\n {\n \"text\": [\n \"Established\"\n ],\n \"cols\": [1],\n \"color\": \"blue\",\n \"bgcolor\": \"\",\n \"alignment\": [\n \"center\"\n ]\n }\n ],\n \"rows\": [\n {\n \"text\": [\n \"443\"\n ],\n \"cols\": [7],\n \"color\": \"white\",\n \"bgcolor\": \"darkRed\",\n \"alignment\": []\n },\n {\n \"text\": [\n \"block-domains\"\n ],\n \"cols\": [13],\n \"color\": \"white\",\n \"bgcolor\": \"darkMagenta\",\n \"alignment\": []\n }\n ]\n }\n }\n}\n```\n
\n\n## Configuration\n\nFormat:\n \n```json\n \"highlight\": {\n \"cells\": [\n {\n \"text\": [\"allow\", \"True\"],\n \"cols\": [3, 4],\n \"color\": \"green\",\n \"bgcolor\": \"\",\n \"alignment\": [\"center\"]\n }\n ]\n \"rows\":[\n {\n \"text\": [\"False\"],\n \"cols\": [3],\n \"color\": \"black\",\n \"bgcolor\": \"darkgray\"\n }\n ]\n }\n```\n\n cells: rules will be applied only on individual cells.\\\n rows: rules will be applied to rows on the given columns.\n\n Fields:\n text: will match any of the given texts (the comparison is an OR operation).\n cols: look for patterns on these columns. The columns start at 0.\n color: colorizes the color of the text.\n bgcolor: colorizes the background color of the cell.\n alignment: cell's text alignment (values: hcenter, vcenter, center).\n\n Color names: https://doc.qt.io/qt-6/qcolor.html#predefined-colors\n\n Notes:\n - There're 3 default configurations that are applied on the views:\n commonDelegateConfig, defaultRulesDelegateConfig and\n defaultFWDelegateConfig\n\n Creating/Copying these configurations under\n XDG_CONFIG_HOME/.config/opensnitch/actions/ allows to overwrite and hence\n personalize the views highlighting colors.\n \n - The columns in the field \"cols\" start at 0.\n\n - The order of the customizations are applied from top to bottom, meaning that\n the last \"rule\" of the \"cells\" or \"rows\" arrays will override previous\n rules if there're conflicts. For example:\n\n [Rules tab]\n Action | Name | Enabled | ...\n drop | allow-always-telnet | False | ...\n\n\n## VirusTotal plugin\n\nThis is a simple plugin that analyzes new outbound connections with virustotal:\n\n\"9-vt-1\"\n\n\n
It also obtains information about domains in the Hosts tab:\n\n\"hosts-vt\"\n\n\n
and adds a tab to the process dialog, which obtains information about the process if the hash was submitted to virustotal.\n\n\"8-vt-1\"\n\n\n
**Privacy warning:** remember that the domains, IPs or hashes will be sent to the servers of virustotal.\n\n## Prerequisites\n\nGet an API key: https://virustotal.readme.io/docs/please-give-me-an-api-key\n\n## Configuration\n\nFirstly add a new rule to allow connections from the GUI to www.virustotal.com:\n\n```json\n{\n \"created\": \"2023-02-19T20:44:36.000000Z\",\n \"name\": \"allow-virustotal\",\n \"enabled\": true,\n \"action\": \"allow\",\n \"duration\": \"always\",\n \"operator\": {\n \"type\": \"list\",\n \"operand\": \"list\",\n \"list\": [\n {\n \"type\": \"simple\",\n \"operand\": \"dest.port\",\n \"data\": \"443\"\n },\n {\n \"type\": \"simple\",\n \"operand\": \"dest.host\",\n \"data\": \"www.virustotal.com\"\n }\n ]\n }\n}\n```\n\nSecondly, create the plugin configuration under `/home//.config/opensnitch/actions/virustotal.json`:\n\n```json\n{\n \"name\": \"virustotal\",\n \"created\": \"\",\n \"updated\": \"\",\n \"description\": \"analyze connections properties with virustotal\",\n \"type\": [\"popups\", \"proc-dialog\", \"main-dialog\"],\n \"actions\": {\n \"virustotal\": {\n \"enabled\": true,\n \"loglevel\": \"debug\",\n \"config\": {\n \"api_timeout\": 2,\n \"api_quota\": 500,\n \"api_key\": \"\",\n \"api_domains_url\": \"https://www.virustotal.com/api/v3/domains/\",\n \"api_ips_url\": \"https://www.virustotal.com/api/v3/ip_addresses/\",\n \"api_files_url\": \"https://www.virustotal.com/api/v3/files/\"\n },\n \"check\": [\"ips\", \"domains\", \"hashes\"],\n \"malicious\": {\n \"minimum-threshold\": 1,\n \"action\": \"reject\",\n \"icon\": \"dialog-warning\",\n \"use-community-score\": true,\n \"use-reputation\": true,\n \"use-suspicious\": true\n },\n \"widgets-colors\": {\n \"malicious\": \"red\",\n \"benign\": \"green\",\n \"unknown\": \"darkOrange\"\n },\n \"exclusions\": {\n \"ips\": [\"127.\", \"192.168.\"],\n \"domains\": [\".lan\"]\n }\n }\n }\n}\n```\n\n|item|value|\n|----|-----|\n|config.api_timeout|maximum allowed time in seconds to obtain a response from the server. 1 is usually too low. 2 or 3 usually works fine.|\n|config.api_quota| Maximum allowed requests. If we exceed this value, we won't try to analyze new connections (they'll be denied anyway). The free account has a limit of 500. If you use a different license, adjust this value accordingly.|\n|malicious.icon|Change the icon of the popup if the connection is flagged as malicious. Leave empty to skip it. The name of the icon depends on the icon theme of your Desktop Environment|\n|malicious.minimum-threshold|The minimum malicious score used to consider an outbound connection potentially malicious.|\n|malicious.use-community-score|Users can vote to flag something as malicious or not (IP, domain, hash, etc).|\n|malicious.use-reputation||\n|exclusions.ips|IPs to exclude from being analyzed. By default private IPs are already excluded. The exclusion will take effect if the IP contains the exclusion|\n|exclusions.domains|Domains to exclude from being analyzed. The exclusion will take effect if the domain contains the exclusion (for example: www.github.com.lan)|\n\n#### API Documentation: \n\n - https://developers.virustotal.com/reference/domain-info\n - https://developers.virustotal.com/reference/domains-1\n - https://developers.virustotal.com/reference/ip-info\n - https://docs.virustotal.com/reference/ip-object\n - https://developers.virustotal.com/reference/file-info\n - https://docs.virustotal.com/reference/files\n"}