The weekly false-positive review that saves your WAF

Here's the pattern: a WAF is deployed. It fires on legitimate traffic. Someone gets a support ticket. An engineer, under pressure, sets the offending rule to log-only or disables it entirely. Six months later half the ruleset is off, and no one remembers why.

The fix is a 30-minute cadence, not a bigger vendor

Every week, someone should look at:

• Top-10 rules by fire count.
• Top-10 rules by false-positive count (if you're logging both).
• Rules that fired zero times in the last 30 days (candidates for deprecation or debugging).

The output is a diff, not a screenshot

Rule changes belong in a pull request. Two reasons: audit trail, and rollback. If a rule change starts blocking legitimate signups, you want to git revert and be back in production in under 5 minutes.

What we do inside an engagement

Every WAF engagement includes this weekly review by default. We ship the diff to your repo, tag your security lead, and merge on approval. It's the single highest-leverage thing you can do for edge security.