Once you become familiar with the basics of the Manager, you can further enhance your deployment by using some of the more advanced features. Trellix IPS is an extremely complex system and can be tuned on a highly granular level. You might try working with some of the following features as you tune your system:
Cloning and modifying a provided policy. For more details, see the section Working with IPS policies.
Creating Firewall policies to block specific traffic or pass specific traffic without sending it through the intrusion detection engine. For more details, see the section User-based access rules.
If you have started out in SPAN mode, you might try taking advantage of Trellix IPS prevention capabilities by deploying your Sensor to monitor traffic in in-line mode. For more details, see the section Deployment of Sensors in in-line mode.
Adding users and assigning management roles. See the section Management of users and user roles for more details.
Adding administrator domains for resource management. See the section Create an admin domain for details.
Changing your interface type to CIDR or VLAN depending on your network configuration. See the section Managing interfaces for more details.