False positives seem like an inevitable side-effect of wanting to minimize false negatives. I've been tuning snort rules for the past couple weeks...