WAF rules that drop the right traffic, not the rest.

The managed rule groups were doing their job — they just weren’t the right job for this traffic pattern. The signup form looked enough like a credential stuffing attempt that the managed rules tagged it. The team had been working around the false positives with retry logic.

We piped all WAF logs to Firehose → S3, queried with Athena, and built a Grafana dashboard of "what would have been blocked, by rule." The first analysis surfaced eight false-positive rules and three genuine threat patterns the managed groups missed.

Custom rules replaced the broad ones for the signup endpoint. Bot Control caught the credential stuffing attempts that the regex-based rules had missed. False-positive rate dropped from 14% to 1%. Genuinely bad traffic now drops at the edge before reaching the origin.