The mere mention of false positives always causes concern in the mind of any security analyst. However, false positives may mean quite differently things to different people. In order to better manage the security risks using any IDS/IPS devices, it's very important to understand the exact meanings of different types of alerts so that appropriate response can be applied.
With Trellix IPS, there are three types of alerts which are often taken as false positives:
incorrectly identified events
correctly identified events subject to interpretation by usage policy
correctly identified events uninteresting to the user