I am scared of all the attacks i see towards our site

Add a WAF?

I'm scared it could block traffic that is legitimate

@dasrecht was also always skeptical of WAFs - but been running AWS WAF for a few years now and we never really had any issues with it blocking the wrong thing.
@euklid same - i had to deal with a lot of bad products in the past. there's the chance of limited impact but that's usually fixed quickly.