Category tuning waf rules minimize false positives