Common False positives/entries to ignore

I have few queries regarding SIEM or log management.

1.What false positives/to ignore entries we see in firewall logs from domain controllers,Ips/Ids,Database logs,Vpn .
3.Does RSA envision connect directly to domain controllers.
4.How to learn basics of firewall log analysis & escalation.

Thanks in advance for your help.

in firewall logs i see port scanning entries populated which we have to ignore.
like this entries logs from dc,database,ips,unix....

Plz help.....
Thanks.

Any one...