All my Joomla sites have just been attacked (with SQL injection and RFI) and Admin Tools appears to have blocked them all - silently, as I hadn't had notifications set up.
WAF defaults are fairly sensible, but there are a few settings you may wish to tweak.
Thanks, Nicholas! :)