An IS auditor finds the log management system is overwhelmed with false positive alerts.

 Fine tuning the intrusion detection system (IDS) is the best recommendation to reduce the number of false positive alerts that overwhelm the log management system, because it can help adjust the sensitivity and accuracy of the IDS rules and signatures to match the network environment and traffic patterns. Establishing criteria for reviewing alerts, recruiting more monitoring personnel, and reducing thefirewall rules are not effective solutions to address theroot cause of the false positive alerts, but rather ways to cope with the consequences. References: CISA Review Manual (Digital Version), Chapter 5, Section5.4.3