It is not uncommon for the number of real attacks to be far below the number of false-alarms.
For signature-based IDSes there will be lag between a new threat discovery and its signature being applied to the IDS.