Every blocklist hit and WAF match is written to the security event log with enough context to investigate

Whenever a request is blocked, whether by the IP blocklist or the WAF, it's recorded as a security event with enough detail to investigate later.