Consider carefully:
- Don’t unblock if you see clear attack patterns or automated attempts
- Consider unblocking if it’s a known user who forgot their password
- Investigate first by reviewing the event details and patterns
- Document your decision and reasoning for audit purposes