1. Use Discover mode to get a “fingerprint” the proper behavior of your app(s) 2. Use Monitor to test those rules. (Add any “false positives” to the list; maybe react to actual attacks) 3. Put groups into Protect mode to block anything not explicitly allowed.