We have had a few HIGH alerts that were not false positives and only come in as email, which can easily get buried. We were lucky that we saw these emails early and able to address. I would also not mind if a HIGH alert came in and I was able to have it "isolate" the endpoint. better safe than sorry.