Your best plan is to start with all the rules in count mode. Let that sit for awhile and analyze anything that was counted. As you feel good about it, slowly start to move things into block.
Then you block sooner and get slammed for blocking too soon.
Repeat for 1000 web services.