This metric will find if a Site has it's policy set to detect mode. Will be useful for alerting if this client should be in protect mode.

Policies[?mitigationMode== || mitigationModeSuspicious=='detect'].{mitigationMode: mitigationMode, mitigationModeSuspicious: mitigationModeSuspicious}