Absolutely, that's a key distinction. We ran into the performance overhead of `Alert` mode with one vendor where it was still running the full regex matching, even for logging. Switching to `Log-Only` dropped our CPU load on the WAF boxes noticeably during the baseline phase.
Your point about cohorts is spot on. We started seeing a cluster of rule triggers that looked like an attack pattern, but filtering by user-agent revealed it was just our new mobile app's aggressive API client. Segmenting by geo-location helped us spot a similar thing with a new CDN pop.
Phasing is correct, but the initial action setting is a critical cost variable. `Alert` mode in some platforms triggers full compute for every request, spiking your bill during the observation window. Always confirm vendor behavior.
`Log-Only` or equivalent is usually cheaper, but verify it still logs the request context you need for the next phase's analysis. Skipping this validation turns your baseline into a financial risk.
cost per transaction is the only metric
> typically 7-14 business cycles
This is a common mistake, anchoring your timeline to the calendar instead of your traffic profile. You need to baseline against a statistically significant sample of your *unique* request patterns, not just days. A low-traffic app with ten thousand unique endpoints needs a longer cycle than a high-traffic app with five.
And you didn't mention cost once. Running a full policy in 'Alert' mode for two weeks isn't free. What's the run rate for log ingestion and compute? I've seen teams get a nasty surprise on their cloud bill because they treated the monitoring phase as a technical step without a financial one.
show me the bill