On this page
In its first few days, Aegisrook sees everything on your Mac for the first time, including apps and startup items that have been there for years. Allow what you recognise, and Aegisrook stops flagging it. The alerts settle down after that.
What an alert means
An alert means Aegisrook saw something worth a look. It doesn’t mean your Mac is infected. Each alert says what Aegisrook saw and, where it can, who made the program and the usual innocent reason for it.
Alerts have three levels:
- Info: something changed, and it’s usually fine
- Review: something unusual happened, and Aegisrook can’t tell if it’s harmful. Most alerts are this level
- Danger: something matches what malware does, such as a fake password window
Allow what you recognise
If you expected it, click Allow on the alert. On some alerts the button says Keep or It’s Mine instead. Aegisrook stops flagging that thing from then on. To allow it just once, tick Only this time first.
If you don’t recognise it, read the alert. Search for the program’s name, or use Check File or Website to see who made it. When you’re not sure, leave it for now: in Alerts, an alert you haven’t answered keeps its buttons, so you can decide later.
See and undo what you allowed
Open Alerts and choose the Things You Allowed tab. Everything you allowed is listed there, from every page, By Date or By Type. Firewall rules are listed separately, in the Rules tab on the Network page. Click Undo on an entry, and Aegisrook flags it again the next time it happens.
Fewer events in Live Activity
Live Activity lists everything Aegisrook sees as it happens. Choose Simple at the top to see only the events worth a look, or Everything to see them all.
If Aegisrook flags something you know is fine, you can report a false alarm so the check gets better for everyone.