LF_MODSEC usage

[swbrains]

When setting LF_MODSEC to 3 (for example), does that mean the offending IP is blocked if the *same* modsec rule is matched 3 times, or does it mean the IP is blocked on the 3rd match of *any* modsec rule?

Thanks for any clarification you can provide!

[Sergio]

Any match of modsec rules 3 times in a row.