Set up a WAF rule set

Configure a Web Application Firewall for [Application] using [AWS WAF / Cloudflare WAF / ModSecurity]. Enable the OWASP Core Rule Set or managed rule group as the baseline. Add custom rules to block [Specific attack pattern, e.g. automated scraping or known bad user agents]. Configure per-IP rate limiting with a sensible threshold and action. Set up real-time alert notifications for blocked requests so the security team can respond to attack patterns. Document how to tune the WAF to reduce false positives without weakening protection.