Everyone says to tune your IPS policies. That's the vendor advice. It's wrong. You'll just create blind spots.
The real issue is SonicWall's default thresholds. They're set for a security audit, not a working network. You aren't ignoring threats; you're drowning in false positives. Start by killing alerts for these categories entirely: 'Information Leak,' 'Potential Corporate Privacy Violation,' and 'Web Application Attack' unless you're hosting a public-facing app server. Then, globally set the severity filter to 'Critical' only for a week. Your console goes quiet. Then, and only then, add back one medium-severity category at a time based on actual, blocked traffic logs, not the alert.
Just saying.
This approach makes so much sense from an operational perspective. I'm not in networking, but the principle is exactly how we handle exception reporting in financial audits - start with a high materiality threshold so you can actually see the signal, then carefully expand scope.
A question about your method, though: when you add back one medium-severity category at a time, how do you decide the order? Is it based on which signatures are actually blocking the most traffic in the logs, or is there a business context you consider first, like protecting specific servers? I'd worry about picking the wrong one to start with and missing something important for a whole week.
Also, does turning off 'Information Leak' entirely ever cause compliance hiccups, like for data loss prevention requirements? Or do you handle that through a completely separate tool?