Outbound: Port Scanning & Brute Force detection

It works just fine using ET Rules to detect outbound SSH scans but I still have issues blocking port scanning outbound.
Any tip for this achievement?
Thank you!