Good questions. This is another great example of "What's the best practice?" that I think we, as a community should better address.
Anyway, since you want to continue to protect the hosts you use to perform network scans, while at the same time filtering out the IDS alerts they generate while performing their assigned tasks, I'd like to suggest some event filters.
I'm going to assume you know how to build event filters, so I'll skip over the instructional elements and get right to the suggestions.
I suggest you start by identifying exactly which SigIDs are being generated by a typical scan (for example, 2100, 3002 and 3030 - which are ICMP netsweep w/ echo, TCP Syn Port sweep and TCP Syn Host sweep respectively. They are common occurrences when network scanners are at work). Take this list of SigIDs and combine it with the two IP addresses as sources to make a filter.
Quick tip - you can put all the SigIDs into one filter by separating them with commas (no spaces). This way, a single event filter can deal with multiple SigIDs for the two IP addresses.
IMHO, it's always better to squelch known false positive/accepted traffic at the sensors, vice filtering it out at the Monitoring Console. Essentially, this improves the value of your collected IDS alarms by not introducing unwanted data to your SecMon (or SIMS), which typicaly employs a backend DB. Less records in the DB means more efficient searches and reports can be generated from it.
I hope this helps,
Alex Arndt
