Ok, but I want to avoid spamming the user with alerts. We could show a warning that the filter is not active and provide the user a means (eg button) to trigger that alert, that will avoid spamming.

@DTS Engineer I've been testing this issue against macOS 15.2 and it seems the problem with the built-in firewall may have been resolved. There's nothing obvious from the release notes though. Can you confirm if the problem has been addressed (or not)?

Bug report submitted, FB15833538

Hi, thanks for the feedback. QQ, just to clarify. Your "Yes" means this should be supported but performance could be an issue, right? Is our approach to using an app activated content filter reporting to a daemon connected via XPC unsupported? Yes. You have to be careful about performance here, but the basic concept is sound. I have been able to test the disabling the built-in firewall and after a restart to flows are received normally by our content filter. This would seem to confirm we're hitting the issue reported by others (FB15699871). I'll work on preparing a bug report and will post it here. Thanks for the help, Dave