The only port scans i'm seeing are from one of my internal machines. Based on the notification email the port scan detection seems to be very basic. Anything that has 10 or more connections in a 1 second time period. The offending server is our internal DNS server, that i'm assuming is forwarding request for unknown DNS request to the root servers...but its odd that i havn't seen even one port scan from Korea or China. Maybe I clicked on the "Enable Port Scan Detection" button the wrong way? [;)]
