Detection & Response
Monitor and Block Modes
Also: audit mode, enforce mode, alert-only mode
Two ways to apply a security rule: monitor only records and alerts, block actually stops the action.
In more detail
Starting in monitor mode shows what a rule would catch without disrupting anyone. Once false positives are low, high-confidence rules move to block, often with an ask step in between where a human approves.