What's the difference between observation mode and blocking?

Observation or Monitor Mode, included on Free, shows real exploitation attempts against your running application, including the route, the CVE, the timestamp, and the source IP. Blocking or Block Mode stops those attempts at runtime before they succeed, closing the window between a CVE being disclosed and your team shipping a patch. Block Mode isn't available on Free.

See: What Is CVE Monitoring vs. Blocking?