Consider a scenario where a FortiWeb WAF, deployed to protect a critical e-commerce platform, is configured with a dual-layer defense: signature-based rules for known exploits and anomaly detection tuned for deviations from baseline user behavior. Following a highly successful marketing campaign that significantly increases user engagement and introduces a variety of complex, albeit legitimate, search queries, the WAF begins generating a high volume of anomaly alerts. This results in a substantial number of valid user requests being flagged and temporarily blocked, impacting customer access and sales. Which of the following adaptive strategies would most effectively address this situation, ensuring both security and availability without compromising the integrity of the anomaly detection system?