What is the ideal correlation condition for port scan? I mean the No of Events per Second so it doesn't result in to false positives.
