When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site?
What techniques can I use to narrow down and figure out what tool is being used?
One reasonable starting point might be checking what the User-Agent is for the requests you are concerned about. I would expect it to be forged, but it may be forged in a way that is still identifiable.
You could also consider profiling a few likely culprits (I would expect at least some tools to have a predictable sequence of attacks), by running them against a test instance of your WAF, and collecting the logs and alerts.
I am not completely sure, though, that you want to be worrying about which script is doing what, so much as what the actual attacks are (and which ones are relevant to you). Although I can totally see how that would be an interesting thing to know.
There is no way to know. You can make an educated guess by searching for the attack vector or looking at the user agent header to see if it contains anything of value. Even then, it means nothing because it can all be altered by the attacker.