## Handling False Positives

Tuning is the job of the Security Engineer.

### Common Causes
1.  **Vulnerability Scanners**: Nessus scans look like attacks. Whitelist the scanner IP.
2.  **Poorly written rules**: A rule checking for "files containing 00" triggers on binary downloads.
3.  **Updates/Software**: A new legit app behaves weirdly.

### Tuning
*   **Disable**: Turn off the rule entirely (Risky).
*   **Suppress**: "Don't alert on this rule for Source IP 1.2.3.4". (Better).
*   **Rewrite**: Make the rule more specific.