diff --git a/cmd/deploy/main.go b/cmd/deploy/main.go
index af9a514..d7c9b1d 100644
--- a/cmd/deploy/main.go
+++ b/cmd/deploy/main.go
@@ -218,18 +218,31 @@ func deployOne(nc nodeConfig) {
 	if nc.Cloud == "" { nc.Cloud = "EU" }
 	if nc.Labels == "" { nc.Labels = "group=" + nc.Name }
 
-	// Ask for block mode
+	// Ask for traffic mode
 	reader := bufio.NewReader(os.Stdin)
 	mode := "monitoring"
+	fmt.Println("\nTraffic processing mode:")
+	fmt.Println("  [1] monitoring     — detect attacks, do not block")
+	fmt.Println("  [2] safe_blocking  — block only definitely malicious requests")
+	fmt.Println("  [3] block          — block all detected attacks")
+	fmt.Println("  [4] off            — disable traffic analysis")
+	def := "1"
 	if nc.BlockMode {
-		fmt.Print("Block mode? [Y/n]: ")
-	} else {
-		fmt.Print("Block mode? [y/N]: ")
+		def = "3"
 	}
+	fmt.Printf("Choose mode [%s]: ", def)
 	ans, _ := reader.ReadString('\n')
-	ans = strings.TrimSpace(strings.ToLower(ans))
-	if ans == "y" || ans == "yes" || (nc.BlockMode && ans == "") {
+	ans = strings.TrimSpace(ans)
+	if ans == "" { ans = def }
+	switch ans {
+	case "2":
+		mode = "safe_blocking"
+	case "3":
 		mode = "block"
+	case "4":
+		mode = "off"
+	default:
+		mode = "monitoring"
 	}
 
 	apiHost := "api.wallarm.com"