A customer has an AOS 10 architecture, which includes Aruba APs. Admins have recently enabled WIDS at the high level. They also enabled alerts and…

The core issue is alert fatigue caused by the "high" Wireless Intrusion Detection System (WIDS) level, which is likely too sensitive for the specific network environment and is generating an excessive number of notifications. The most effective initial step is to tune the system. By changing the WIDS level to "custom," administrators can deselect the specific checks that are generating noise or false positives while keeping the protections for high-fidelity, critical threats enabled. This approach directly reduces the volume of irrelevant alerts without compromising the overall security posture, making the notification system manageable and useful again.

A: This is a procedural workaround that ignores the root cause. Hiding alerts increases the risk of missing a critical, time-sensitive threat and is poor security practice.

B: Disabling an entire category of threats, such as Rogue AP detection, is a drastic measure that creates a significant security gap. The problem is likely sensitivity, not the category itself.

D: These alert categories are distinct and detect different types of attacks. They do not inherently overlap, and disabling two of the three would severely weaken the WIDS protection.

1. ArubaOS 10.5.x.x User Guide: In the section on configuring Intrusion Detection System (IDS)

the guide details the different protection levels. It explains that predefined levels (Low

Medium

High) enable a set of signatures

but the "Custom" level provides granular control. This allows an administrator to enable or disable individual protection types to tailor the IDS to their specific environment

which is the standard procedure for reducing false positives and alert fatigue. (Reference: ArubaOS 10.5.x.x User Guide

Chapter: "Configuring IDS"

Section: "IDS Configuration Workflow").

2. Aruba Central Help Center - Configuring IDS: The documentation for configuring IDS within Aruba Central (which manages AOS 10) describes the process of creating and customizing IDS profiles. It explicitly shows how administrators can move from a predefined level to a custom one

where they can check or uncheck specific infrastructure and client attack detections. This functionality is designed precisely for the scenario described: tuning the system to reduce noise. (Reference: Aruba Central Help

Page: "Configuring Intrusion Detection System (IDS)").