great comment. thing i’d add for folks who want to play with this, follow this setup exactly and turn every rule on but don’t perform any blocking. then review

great comment. thing i’d add for folks who want to play with this, follow this setup exactly and turn every rule on but don’t perform any blocking. then review the logs and dial back unnecessary rules. very “fun” exercise in a lab for a student xD