A number of rules are meant to be advisory in nature; for example, SID 11968 (“VOIP-SIP inbound INVITE message”) will tell you if you’ve got SIP traffic on segments of your network where it’s not supposed to be. Other rules can be performance-intensive, and should only be run if you really need the coverage. Thinking that the more rules you have, the better your protection will be (I’m looking at you, MSSPs) can cause you a world of hurt.”]
Source: https://blog.talosintelligence.com/2010/01/vrt-guide-to-ids-ruleset-tuning.html