Snort configuration question

flagged for deletion.

There is not a full answer, you enable the protections you feel are needed and back them off when there are too many false positives. You can also use the built option “Use IPS Policy”