3537-0 (MailEnable HTTP Authorization) false positives

[mhellman]

This signature fires on NTLM authentications.

[pradeepde]

Try this link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/prod_tech_notes_list.html

[mhellman]

we already tuned. btw, that link has some seriously outdated information in it...especially with respect to tuning false positives.