Set the action of the web ACL rules to Count Enable AWS WAF logging. Analyze the requests for false positives.

Modify the rules to avoid any false positive. Over time, change the action of the web ACL rules from Count to Block.

Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible. Temporarily block all

requests that exceed the limit. Define nested rules to narrow the scope of the rate tracking

Set the action of the web ACL rules to Block. Use only AWS managed rule groups in the web ACLs.

Evaluate the rule groups by using Amazon CloudWatch metrics with AWS WAF sampled requests or AWS WAF logs.

Use only custom rule groups in the web ACLs, and set the action to Allow. Enable AWS WAF logging.

Analyze the requests for false positives. Modify the rules to avoid any false positive. Over time, change the action of the

web ACL rules from Allow to Block