Set it to high and only enable the first checkbox. That’s how I use it and haven’t got a single thing from it, but should be trigger happy on actual malware. Second checkbox involves everything from suspicious or potentially malicious behavior.