WAF rules: Update mode