Set service scope, HTTP methods and body inspection limits, and switch SQL injection, script injection, path traversal and scanner rules off, to observe or to block. Test saved policies and review observation records.