A company is deploying intrusion protection using Cisco FTDs managed by Cisco FMC. Which action must be selected so that fewer rules detect only critical conditions and false positives are avoided?