Intrusion Detection Systems (IDS)

It seemed to me that IDSs catch automated bots or less-important attacks that don’t matter if you spend a day configuring your security. They fail to detect attacks that actually matter. Also lots of false positives and fine tuning.

Is that still true?