I've enabled WIPS on several APs & their controller. I enabled all alerts available in the WIPS policy I created.
I'm receiving many "excessive scanning" alerts from numerous devices but I can't find any information about this situation. What is "excessive scanning"? Does it pose a threat?
Is there any best practice document available for setting up/maintaining WING WIPS?
When you enabled the events, you must have configured some thresholds. Check the WIPS Events --> Excessive tab. The Event is triggered when the sensor finds a certain number of probe requests within a certain time interval (say Y). Both these fields are configurable and the default number is 30 scans for one client. So if you configure the time interval (Y) to 1 minute, then it is easy to trigger the event.
Please check what values are configured. For these events, you can configure thresholds depending upon how aggressive detection you want.