Does the alert have teeth?
The port-scan alert on its own is low value — the internet scans everything. The question is whether that same IP did anything. Pivot it into the auth log:
grep '203.0.113.66' /srv/soc-data/linux/auth.log | grep -E 'Accepted|new user'In the terminal
student@vulntech:~$ grep '203.0.113.66' /srv/soc-data/linux/auth.log | grep -E 'Accepted|new user' Mar 10 08:03:52 web01 sshd[9140]: Accepted password for svc-backup from 203.0.113.66 port 40511 ssh2
A successful Accepted password from the scanning IP turns a routine scan alert into a confirmed intrusion. That is the moment a triage verdict flips to true positive, high severity.