Always-on detections: eliminating the WAF “log versus block” trade-off