Hi Sumit,

You can reduce false positive incidents by fine tunning the policy. U can do this by adding some exception and adding whitelist. At network u can prepare email whitelist and at endpoints u can us IP filtering solutions.

also refer below

https://www-secure.symantec.com/connect/forums/fal...