Usefulness of these Internal Rules fired from LEM Appliance

You're looking at the result of a rule firing, which is to create an inference, which shows up in a filter.  If you look at the rule that creates these inferences, you'll see the LEM is basically looking for specific events and then drawing attention to them.  You might want to look at the rule, figure out what's triggering it, and then look for the original event/events that caused the inference.  In the case below, it takes 10 events in 10 seconds to trigger that inference.

So in this case, I'd go back to nDepth in the EXPLORE tab, and I'd look for those TCPTrafficAudit.AlertActivityType = TCP missing SYN Flag events from around the detection time (17:56:35 Mon Mar 03 2014±10 minutes in this case) and see if maybe something suspicious was going on.

You could also use the "Explore Event" option on the Rule result that you're seeing, and it should show you all the events that triggered the rule at that time (though I've heard there are some issues with this feature at the moment)

I agree with the issue with the Explore-Event feature. I had hit and miss with backtracking the inference rule that was fired.

For extremely large amounts of inference rule firing, I would capture that information and turn off the inference.   I have seen cases there several of the default inference rules fired more than 10,000 per minute and  really slowed down LEM to a crawl. 

To add to what's already been said, the purpose of these out of the box rules is to detect common patterns within network traffic, e.g. many SYN packets = SYN scan type stuff. They also provide some insight into how events are normalized, if you look at those plus the authentication default rules which are similar.

That said, the default thresholds are likely low in many cases, and they may not be useful for you depending on what you want to monitor. You can tweak the thresholds pretty easily to make them fire less frequently, or just disable them if they aren't interesting. If they fire too often or you have a lot of network traffic, you could be impacting load on the appliance (or require more resources than you actually need).

Ok, now I see how these are used.  I believe I will reduce the threshold and check some of these out to see if there needs to be any action taken.  I just didn't know what they were useful for initially, but now I see the purpose.  Thanks!