There is no 'Observation Mode' under Action Enforcement Settings yet McAfee logs say the malware (rated most likely malicious) is not blocked due to being in observation mode. Any idea why?