Google Cloud Armor

We have set up Google Cloud Armor rules which are blocking some of the real requests on our website. We need help to make sure all the real/safe requests on our website are done properly so it does not trigger those rules.

These are the rules we are using
evaluatePreconfiguredExpr('lfi-stable')
evaluatePreconfiguredExpr('rfi-stable')
evaluatePreconfiguredExpr('rce-stable')
evaluatePreconfiguredExpr('methodenforcement-stable')
evaluatePreconfiguredExpr('scannerdetection-stable')
evaluatePreconfiguredExpr('php-stable')

These are the rules that are being triggered
evaluatePreconfiguredExpr('sessionfixation-stable')
evaluatePreconfiguredExpr('sqli-stable')
evaluatePreconfiguredExpr('sessionfixation-stable')
evaluatePreconfiguredExpr('protocolattack-stable')
evaluatePreconfiguredExpr('xss-stable')

We are using an Nginx webserver