In an alert how to enable a rule only for the IP address/domain listed in the alert

[halloleo]

I have installed Lulu and I get now as expected the "App is connecting to P address/domain" alert. For example it says "Mail is connecting to s3-ap-southeast-2.amazonaws.com".

I now would like to allow only the connection to s3-ap-southeast-2.amazonaws.com. However when I click "Allow" in the alert Lulu creates a rule allowing all connections from Mail. How can I limited it to the destination of the current connection attempt?

Many thanks for any pointers!

[objective-see]

In the alert, click on "Details & Options", then select "Remote Endpoint":

...this will create a rule, just for the process, but only to the (remote) endpoint!

[halloleo]

Thanks you. So, I understand:

• "Process" creates a rule for this process to all endpoints
• "Remote Endpoint" creates a rule for this process to only this endpoint.

Is this correct?