"When LS encounters a connection attempt that is not yet covered by an existing rule, it shows a Connection Alert, allowing you to decide whether to allow or deny the connection" This I gather is when the pertinent image will appear?
Correct.
Little Snitch is neat in that it doesn't have to be updated as do anti-virus apps; if you pick up a "bug", you know it as soon as it tries to call home and LS alerts you, and your forever denial neutralizes it immediately. You could call it user-assisted self-updating.
Happy to have been (able to be) helpful.
