There are two ways on how to run an IDS:
- to detect attack attempts
- to detect successful attacks
The mode is defined by the rules which are enabled. In most environments, like yours, there is no clear strategy which leads to having both kinds of events triggered.
If you want to detect possibly successful attacks only (and ignoring attempts which are not successful anyway), just enable the signatures for products and versions you are using. For example if you are not using Apache, then disable all Apache signatures. It may take some time to collect data about your software inventory and to implement it on the IDS. Furthermore you would have to make changes on the IDS whenever your software landscape changes. Don't underestimate the effort for that. But then you are able to determine attack attempts and possible success which might really impact your environment sooner or later.
Furthermore, IDS/IPS signatures usually come with categories. For example the protection filters by TippingPoint are using the categories Reconnaissance for enumeration, Vulnerabilities for common security issue detection and Exploits for actions provoked by real attack attempts. Stripping down the enabled categories might also help to prevent noise not linked to successful attacks.