An IDS in a production environment generates an alert for an inbound connection matching an exploit signature for a service that is not running on the target host. After verification, this is classified as a false positive. What tuning action reduces similar false positives for this specific rule?

The correct tuning action is to add a suppression or exception for the specific destination IP/port combination where the service is not present. This eliminates the false positive for that host and port without removing the detection for hosts where the service does run. Deleting the IDS rule entirely is wrong because it removes valid detection capability for all other hosts where the service exists. Lowering the rule priority from high to low is wrong because it does not eliminate the false positive; it just buries it in the queue, wasting analyst time. Moving the IDS sensor to a different network segment is wrong because it changes coverage, not the rule's applicability.