IPX signature matches are classified as one of the four types listed in the slide.
False positives are the main reason that we implement IPX tuning and could potentially drop normal traffic.
Ideally there would only be true positive and true negative matches.
That is what we want the IP to achieve 100 percent of the time.
The IP ass tuning process can be used to help ensure that the alerts you are seeing are real actionable
information without tuning.
You will potentially have thousands of benign events also known as false positives making it difficult
for you to conduct any security research or forensics on the network.
Cisco is power system actually has an auto tuning feature that will tune IP policies to match the traffic
in your environment.
So here I am in the IP policy configuration and firepower and if you click on firepower recommendations
you can actually set your IP policy to be based off of traffic that firepower has learned about.
So based on the traffic in my network there were 139 rules set to only alert and then 5000 354 set to
drop an alert.
And then almost 14000 rules were disabled because based on the traffic flows through my sensors firepower
determine that those rules were not necessary to be unable.
So this can really improve performance and make sure they dont have so many false readings when you're
analyzing intrusion events.