apparmor question


Searched briefly but could not find a specific answer.

Was using Fedora a few weeks ago and while using firefox I rec’d
a screen message that an intruder was present and blocked out thru their
SELinux program, right after standard install.

I enabled AppArmor here on Suse 11.3 and it tells me an email message
will be sent, how I don’t know, for security violations. There are ten
profiles here but only about half are enabled, all enforced. Firefox can
be added as a program to watch in AppArmor. Great.

Will AppArmor give me a screen message if an outside intruder appears if
I add firefox as a program to watch and the outside intruder violation occurs
while using firefox ? Do I need to add firefox for this to happen or do any
outside intruders generate a message while the internet is connected ?
Certainly a great feature if I can be sure it’s working.