No CAPTCHA - URL is not yet qualified for challenge injection

Hi,   I am setting up Brute Force protection in ASM and have noted that I can get this drop traffic and alert, but when attempting to show the CAPTCHA, I only get the blocking page we have config...