For incoming traffic I don't really care. The vast majority of such traffic is automated systems like bots and scripts looking for low hanging fruit to compromi

For incoming traffic I don't really care. The vast majority of such traffic is automated systems like bots and scripts looking for low hanging fruit to compromise. It is fine to run a low-level watchdog that throws a temporary source block on the firewall when it detects this traffic, but this is mainly to keep people happy (omg we're under attack!!!!) and keep the logs less cluttered. It doesn't do much to contribute to actual network security. Most real threats are going to be smarter than that. You should already be running your own scans, anyway, so you'll know if there's a problem. If a scan is spotted in outgoing traffic, I would be concerned that there was a dumb bot of some kind running inside the network. In the case of a service provider network, they want to make sure they are not facilitating criminals, either directly as their customer, or by hosting compromised systems. A serious, targeted attack won't use an aggressive nmap type scan, but plenty of low effort malware scripts and bots will.