clarify intent

Author: buixor

crowdsec-docs/unversioned/console/remediation_metrics.mdx

@@ -18,7 +18,7 @@ It provides key insights into:
 - The blocklist that contribute to remediate malicious traffic
 
 The page is divided into three main sections:
-- **Malicious Intents** – A breakdown of attack types associated over time and the total number of attacks prevented.
+- **Malicious Intents** – A breakdown of attack types associated with the IPs that your remediation components blocked.
 - **Malicious Traffic Dropped/Discarded** – Raw and estimated data showing how much malicious traffic has been dropped by your remediation components.
 - **Projected Resources Saved** – An estimate of the resources preserved thanks to traffic being dropped (e.g., storage, bandwidth, log volume).
 
@@ -30,7 +30,7 @@ At the top of the page, you'll see the **Total Prevented Attacks** for the selec
 
 ![Total Prevented Attacks](/img/console/remediation_metrics/rc-metrics-total-prevented-attacks.png)
 
-The **Malicious Intents** section provides a detailed breakdown of the types of attacks that were prevented. These are based on the behavior and typology of IPs remediated by your remediation components, including blocklists and security engines.
+The **Malicious Intents** section provides a detailed breakdown of the typical behaviour associated with the blocked IPs. It shows the behaviour and typology of IPs remediated by your remediation components, including blocklists and security engines. The displayed intent might differ from the behaviours observed from this IP in your context, as it reflects the most commonly observed attacks by the CrowdSec network for a given IP.
 
 ![Malicious Intents Breakdown](/img/console/remediation_metrics/rc-metrics-malicious-intents.png)