Lack of visibility limits usability
I agree with other reviewers that the ability to understand why a request is counted or blocked is paramount.
In the current scenario we will be required to create custom rules to detect and allow any false positives, in order to have working solution. It would be much more useful to at least output the rule and condition that was triggers, along with the request. It would be good to be able to disable a specific rule if it was triggered.
I understand that we should not be able to list the actual rule details, but not having a list of the rule coverage also seems bad.
This box is just a bit too black for my liking. Knowing what protection is in place is a cornerstone of good security. I don't have that with this offering.