"Should I run the unit in promiscuous for awhile before going inline? "
Unless you have a high tolerance for dropped traffic...yes.
"Would running in promiscuous allow me to see what SIGs when be denied and allow me to adjust until I go inline?"
yes, but you won't be in "promiscious mode per say". You will create your inline pair as normal and then create an event action filter that removes any actions that interfere with the normal flow of traffic:
Deny Attacker Inline
Deny Attacker Service Pair Inline
Deny Attacker Victim Pair Inline
Deny Connection Inline
Deny Packet Inline
Request Block Connection
Request Block Host
Request Rate Limit
Request Snmp Trap
Reset Tcp Connection
You might also want to open your SIG policy using "select by: active signatures" and sort by engine (click the engine column header). Find any normalizer sigs that have an deny/modify action and add the "product alert" and "produce verbose alert" actions. You probably shouldn't add actions to sigs that don't have any action. There are a couple normalizer sigs like this, the point of which I don't know.
