The reason why Action Taken is set to Detected is because when there are suspicious attempts, it operates as ‘recording’ instead of ‘blocking’ the traffic. The hacking attempts that only are detected are not a serious issue so you do not have to worry.
Blocked means that we blocked the hacking attempt and we usually send out a 502 Bad Request error message to the hacker's internet browser. Cloudbric automatically blocks critical hack attacks so you do not need to worry about it. User Action shows what action the user took for a corresponding IP. Therefore, it informs whether the user had a blocked IP or is in a country blocked by Cloudbric.