Writing good WAF rules takes research into attacks as they appear. Cloud providers and security vendors therefore offer rule groups that they maintain: general protection against the OWASP Top 10 style of attacks, rules for specific products such as WordPress, and emergency rules for a particular vulnerability that has just been disclosed.
The benefit is speed and coverage. When a new flaw is announced, the vendor can add a rule and every customer who has the group enabled is covered without any work. The cost is that you rely on someone else's rules, which may block legitimate traffic or may miss a variation of the attack.
Most services let you run a new rule in count or log-only mode first, so that you can see what it would have blocked before it affects real users. That is a good habit for any rule change.
Check which rule groups are switched on, make sure automatic updates are enabled, and remember that a rule written for one known exploit is a stop-gap and not a fix for the underlying bug.