LEM Portscan rule

Hi all,

I have a question based on LEM portscan conditions. See attached snapshot for guidance.

I want to create a portscan rule which will ignore posrtscan activities originating from public IP's, but the destination should be on my internal network.

I want to detect external public IP's performing portscan activities in my internal network.

see attached screenshot to correct me.