Your policy determines what traffic analysis your Sensor will perform. Trellix IPS provides a number of policy templates to get you started toward your ultimate goal: prevent attacks from damaging your network, and limit the alerts displayed in the Attack Log to those which are valid and useful for your analysis.
There are two stages to this process: initial policy configuration and policy tuning. Policy tuning is renowned to be a tedious task. However, because networks and attacks constantly evolve, the policy tuning process is never truly complete. Instead, you might equate it to a disk defragmentation; the more often you do it, the less time each check takes. The ultimate goal of policy tuning is to eliminate false positives and noise and avoid overwhelming quantities of legitimate, but anticipated alerts.