In the ideal situation you would put together a list of all assets and threat vectors on your network, including but not limited to:
- Operating system flavors and versions
- Network infrastructure
- Anything else plugged into the network
With that you could plow through all of the signatures that are available and include only the ones that apply to you. For instance, if Solaris does not exist on your network, then there is probably no reason to include a signature for CVE-2007-0882 (the telnet auth bypass). In this case you can determine, within some degree of accuracy, which classes of rules need to be enabled before you even insert your first sensor. Keeping in mind that these signatures are constantly being updated and added to, you are better off thinking in terms of types of signature instead of specific signatures.
If you have a tightly regulated network, then go through your CMDB to build out this information. If you don't have a CMDB this might be a good time to get one started. If you are not in a tightly controlled network then you can get started by doing flow analysis or review packet captures. A good vulnerability assessment tool might also help give you a list of what's out there.
In either case, you should assume that whatever picture you develop is incomplete. I would recommend erring on the side of enabling too many rules, and just plan for a pretty intense initial tuning.
Never forget that an IPS/IDS system does have a fair amount of on-going maintenance. As signatures are updated and systems/applications are added/subtracted you will need to evaluate what you're looking for.