$should_log = $result->is_enforced_block()
    || $result->is_monitored()
    || ($result->code === ResultCode::ALLOWED && $this->config->verbose);

return [
    'preset'     => 'minimal',
    'strictness' => 'monitor-only',
    'logging'    => true,
    'verbose'    => true,   // ← ADD THIS
];

return [
    'preset'     => 'minimal',
    'strictness' => 'monitor-only',
    'logging'    => true,
    'verbose'    => true,

    // Pick what you want to see in logs:
    'rate_limit_enabled'              => true,   // See 429s
    'enable_behavioral_analysis'      => true,   // See botnet patterns
    'enable_fingerprinting'           => true,   // See JA3/HTTP2 hits
    'enable_head_request_detection'   => true,   // See HEAD enumeration
    'enable_asset_scraping_detection' => true,   // See image/PDF scraping
    'enable_client_hints_validation'  => true,   // See spoofed Chrome UAs
    'enable_agentic_detection'        => true,   // See AI agent patterns
];

return [
    'preset'     => 'minimal',
    'strictness' => 'normal',   // ← CHANGE THIS
    'logging'    => true,
    'verbose'    => true,
];

-- 1. Sanity check: is anything being logged at all?
SELECT COUNT(*) AS total_rows
FROM bad_behaviour
WHERE date >= CURDATE();

-- Expected: dozens to thousands depending on traffic

-- 2. What's the enforcement split?
SELECT enforcement_action, COUNT(*) AS n
FROM bad_behaviour
WHERE date >= CURDATE()
GROUP BY enforcement_action;

-- Expected (monitor-only + verbose=false):
--   enforced   ~0-20       (only empty UA + raw XSS)
--   monitored  ~50-5000    (would-have-blocked bots + attacks)
--   allowed    0           (skipped without verbose)

-- 3. Which bots are being seen?
SELECT status_code, COUNT(*) AS n
FROM bad_behaviour
WHERE enforcement_action = 'monitored'
  AND date >= CURDATE()
GROUP BY status_code
ORDER BY n DESC;

-- 4. Top offenders (IPs with most would-have-blocked hits)
SELECT ip, COUNT(*) AS monitored_hits, MIN(date) AS first_seen
FROM bad_behaviour
WHERE enforcement_action = 'monitored'
  AND date >= NOW() - INTERVAL 7 DAY
GROUP BY ip
ORDER BY monitored_hits DESC
LIMIT 20;

-- 5. Did anything actually get a 403? (Should be empty UA + raw XSS only)
SELECT ip, status_code, status_message, date
FROM bad_behaviour
WHERE enforcement_action = 'enforced'
ORDER BY date DESC
LIMIT 50;

-- 6. Bot category breakdown (good for "are AI crawlers hitting me?")
SELECT 
    JSON_UNQUOTE(JSON_EXTRACT(metadata, '$.bot_category')) AS bot_category,
    status_code,
    COUNT(*) AS n
FROM bad_behaviour
WHERE date >= CURDATE()
  AND JSON_EXTRACT(metadata, '$.bot_category') IS NOT NULL
GROUP BY bot_category, status_code
ORDER BY n DESC;