Sandfly is written to have an extremely low chance of false alarms. However, in some environments you may have a configuration that can cause a sandfly to activate repeatedly when it should not. In these cases you have two options:
Whitelist that sandfly for that particular host so that it never activates but is still active for all other systems. Learn more about this option in the Whitelisting a Sandfly article.
Disable the sandfly entirely so that it does not run against any of your hosts. Learn more about this option in the Activating and Deactivating Sandflies article.