Hi Mike,
I agree that there isn't a perfect default set of checks to perform for any app. Here are some thoughts though on a baseline:
I'd skip:
Mandatory HTTP header is missing - only useful if the application requires a particular HTTP header but doesn't check to see that it's present. I've never seen such a requirement in an enterprise level app.
Failed to convert character - Not generally an issue in typical ISO-8859-1 / UTF8 web apps.
I'd add:
Illegal HTTP status in response - block 5xx responses from getting back to the client (and for cosmetic reasons, if the app does not have a custom 404 page, block 404s as well)
Illegal meta character in parameter name - consider blocking
< or
> (xss and other scripting attacks),
' (SQL injection),
% (percent/URL encoding),
&; (at least one of these three characters to prevent use in combination for unicode encoding),
Illegal meta character in header - see above
Illegal meta character in parameter value - see above
The metacharacter checks are the ones that take the longest to tune. But once you do, you end up with a very secure policy. The policy builder can help automate this process.
Aaron