Firewall connection alert.
Hello Bill Leeper,
Sophos Home is managed in the cloud and the backend servers for communication are different from the download servers, thus an as yet unknown connection is expected.InstallationAlert - guess it informs the backend of the status of the installation. Note that the device needs to register properly in order for Home to work (how else could the license be validated and enforced?).
I think I got it figured out. It looks to be tied to SophosWebIntelligence.bundle
"Sophos anti-virus has a built-in feature called Web Protection. If Web Protection is enabled, Sophos reroutes all network traffic through Sophos in order to analyze the content. Thus Sophos creates all network request instead of the original application."
That would explain all the traffic from InstallationDeployer. Denying it just lets the traffic connect normally. Seems to me though that this would defeat the whole purpose of anonymous surfing. Anyway, thanks for your interest.