In my experience on smaller networks, reconnaissance IPs are not usually where the attacks come from and so it is difficult to know more than 'we are being scanned'.