The process of classifying the attack alerts that an IDPS detects in order to distinguish or sort false positives from actual attacks more efficiently.