A retail company deploys AWS WAF on its Application Load Balancer using the AWS Managed Rules Common Rule Set (CRS) to satisfy a new compliance mandate. Shortly after enabling the web ACL in Block mode, legitimate customer checkout requests containing long product descriptions and base64-encoded attachments begin returning HTTP 403 errors. The security team must keep the compliance protection active while eliminating the false positives, and they need evidence of exactly which rules are triggering on legitimate traffic before making changes. What is the MOST appropriate approach?