Always project policyMode_s and filter on it explicitly. A Block in Prevention mode means something was stopped. A Block in Detection mode means something was observed and waved through. They are not the same event and should never be counted together in a dashboard or alert rule.
const char *name = mog_arg_string(args, 0);
。PDF资料对此有专业解读
avg := average(scores);
第十条 行政执法监督机构应当加强对行政执法主体资格的管理，加强对行政执法人员的监督，健全行政执法人员资格、证件管理制度，监督行政执法机关做好行政执法人员准入和退出工作。