Detection value depends on where the decision can be used.

Edge controls are fast

CDN and WAF controls can reduce load early, but they may lack the account and session context needed for subtle decisions.

Application context is richer

Application logic can see user history and business meaning, but it may be too late to protect expensive paths.

Analysts need evidence

Any production decision should leave enough logs for review, rollback, and tuning.