Hi Rob,
You can try simple SQL Injection attacks in one of the parameters you are submitting in a HTML form or even a XSS attack. Both should get detected and trigger the WAF.
Sample SQL Injection at it's simplest: ' || 1 = 1
Sample simple XSS : '/><script>alert("hello")</script>
------------------------------
Rohit Satyanarayana
IBM
Singapore
------------------------------