Defining "internal networks" (as event variables) does not do much by itself. If your goal is to prevent a certain false positive (like the TCP SYN Host Sweeps from a proxy), then you must create an event action filter.
proxy servers will naturally trigger false positives on a few of the sweep signatures. You might consider creating a HTTP_PROXY event variable and then creating an event action filter that subtracts the 'product alert' action for those sigs. You're likely to add other sigs over time as well.
I find that defining event variables for my networks has two primary benefits:
1) we have too many DMZ segments to memorize and it describes them nicely in the alarm (whether I use the variable in a filter or not)
2) filters are much easier to understand when using variables. plus, you don't have to modify multiple rules if something changes. You just modify the event variable.
re: limewire, don't know about that one. I would verify that it is truly limewire being detected (turn on the "log pair packets" action for that sig). If it is, and your policy is to not allow limewire, then go ahead and block it.
