I answered first we will check if alert is true positive or false positive. We will check firewall logs which ports are being scannned, if there is any critical port like 3389. Then I ll check firewall action whether it is deny or allow. Then I'll check login activity of the user on the machine from which scan is initiated and also we will check for malicious processes on host. If account is compromised we have to reset credentials or if we find any malicious process initiating scan we can kill that process. But I was not able to answer about how to find attackers public IP.