Firepower recommendations for intrusion polciy

[ashaw216]

We have a separate intrusion policy for ingress trafffic from the internet to our DMZ servers. When I run Firepower Recommendation on this policy, it suggests changing dozens of old browser vulnerability snort rules from Disabled to Generate Event and Drop. I'm trying to figure out why it thinks these are needed. Can anyone shed some light on this?

[Marvin Rhoads]

Is your network discovery policy properly set to include discovery of only $HOME_NET and exclude $EXTERNAL_NET?

If it isn't, it may be making recommendations based on the observed incoming user-agents (which loosely map to browser types).