I have my firewall events get reviewed by the local model on my mac studio. I had to stop sending the full event because the model would refuse some requests.