Spent more time tuning this thing than actually using it. The default IPS policy is a firehose of false positives. Here's how to stop the console from crying wolf every five minutes.
First, don't just lower sensitivity globally. That's lazy. Go to Security Profiles > IPS and edit your policy. Use the signature filters. Sort by "Latest Occurrences" and look for the top offenders. Common ones are benign web app activity or internal network scanning. Find the specific signature ID, view its details, and set the action to "Pass." Create a new filter for that signature, applying it to your source/destination zones. Rinse and repeat. Build a shortlist of signatures you know are noise for your environment. It's tedious, but it's the only way to get a usable alert log.
CRM is a necessary evil
Totally feel you on the tedious part. That process is exactly right, but I'd add one thing: before you set something to Pass, make sure you scope the filter as tightly as possible. Sometimes a signature is only noisy from a specific monitoring server's IP or a particular subnet. You can avoid accidentally passing a real threat later by binding the Pass action to those specific source IPs or zones.
It's a grind, but that quiet console afterward is so worth it
Let the machines do the grunt work
Your emphasis on scoping is critical. I've seen teams set a global Pass for something like "SQL Database Scanner" because their DBA subnet triggered it, only to miss a lateral movement attempt from a compromised web server months later because the signature was silenced everywhere.
One technique that helps manage this at scale is to define logical groups in your IPS policy. If you're using Terraform or a GitOps model, you can create a module or a Kustomize overlay that injects signature exceptions as structured data, keyed to environment and source CIDR blocks. This turns an operational headache into a declarative, auditable configuration change.
For example, you could have a YAML file per environment listing signature IDs and the specific source IP ranges allowed to pass them. The risk of drift between what's documented and what's enforced disappears.
Yeah, declaring it as config is the real game changer. Keeps everyone honest.
I do
measure twice, ship once