What is the difference between "Blocks" and "Detections" in a notification?

Short answer

Both are options in the Count field of the advanced notification trigger. Blocks counts only the requests that are blocked because their attack score reached the blocking threshold. Detections counts all the requests whose attack score reaches the blocking threshold: those that are blocked, those that are passed because the host group is in Monitor mode and those that are recognized by Teacher and passed. For this reason, Detections is always greater than or equal to Blocks; in a host group in Monitor mode, Blocks never increases. The same distinction also exists in the per-second thresholds: Block Threshold (per sec) counts the blocked ones and Detected Attack Threshold (per sec) counts the total of the three cases; the WAF Blocked Requests and WAF Detected Attack Requests panels on the Dashboard also use the same definition. Traffic in Learning mode, requests that stay below the threshold (including those that only trigger a signature in the Monitor state) and requests whose scan could not be completed within the time limit (including those blocked in Blocking mode) are included in neither count.

Comparison

Request	Blocks	Detections	Dashboard panel
Score reached the threshold, host group in Blocking mode (blocked)	Counted	Counted	WAF Blocked Requests and WAF Detected Attack Requests
Score reached the threshold, host group in Monitor mode (passed)	Not counted	Counted	WAF Detected Attack Requests
Score reached the threshold, recognized by Teacher (passed)	Not counted	Counted	WAF Detected Attack Requests
Score stayed below the threshold, a signature in the Monitor state was triggered	Not counted	Not counted	None (written to Event Logs)
Host group in Learning mode or a Conditional Learning source	Not counted	Not counted	-
Whitelist or static content (not inspected)	Not counted	Not counted	-
The scan could not be completed within the time limit (blocked in Blocking mode; passed in Learning or Monitor mode and in a Teacher or Conditional Learning request, except for an exception that can occur while the rules are loading)	Not counted	Not counted	-

The counting is done according to the result of the request in WAF Inspection Distribution: Blocks = Blocked; Detections = Blocked + Monitor + Teacher (What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?).

Which One Is Selected When?

Situation	Suitable count
Host groups are in Monitor mode; the attack intensity is monitored before switching to blocking	Detections
Host groups are in Blocking mode; only the traffic that is actually blocked matters	Blocks
The attacks produced by Teacher sources (test, scanning tools) should also be seen	Detections
An advanced trigger whose report attachment should contain only the blocked records	Blocks (the report attachment is limited to the blocked records)

In the summary sentence on the Notifications card, Blocks is written as blocks and Detections as detections; in the notification text, the expressions WAF blocks and detected WAF attacks are used.

Common Misconceptions

• "Detections counts every record in Event Logs." Requests that stay below the threshold and only trigger a signature in the Monitor state are written to Event Logs but are not included in the Detections count.
• "The Blocks trigger also works in Monitor mode." In Monitor mode, the Blocks counter does not increase because the request is not blocked; during the monitoring period, Detections is selected.
• "Attacks in Learning mode are included in Detections." In Learning mode, the rules are not applied; this traffic is included in neither count.

How it is done in the documentation

• Notifications · Count
• Notifications · Detected Attack Threshold (per sec)
• Dashboard · WAF Detected Attack Requests

Related questions

• How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?
• What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?
• In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?