I have my IPS reporting to MARS and I am currently getting a lot of events that are being caused by metacomponents. It is my understanding that these metacomponents should not be producing any events/alerts.
This is occurring with a number of signatures. Have doubled checked that the signatures are in their default state with no actions defined.
Anyone know where I should start looking or is this the correct behavior.