This search is still a work in progress, but thought I would go ahead and post it. Currently use OPNsense firewall in my house. The purpose of the search is to identify blocked scanning activity on my firewall that does a 2nd search via a join to add if any src_ip that had been blocked was actually allowed through my firewall. You will need to adjust the 2 base searches to match your environment. If you find a better way, please share to improve this search.
Change index=* to match your index name.
index=* sourcetype="opnsense:filterlog" action=block src_ip!=192.168.0.0/16 | iplocation src_ip | fillnull value=null Country | stats count by src_ip dest_port Country | eval dest_port_bar="".count." attempts on port "+dest_port | stats list(dest_port_bar) as "Ports" dc(dest_port) as "Number of Ports scanned" sum(count) as Total by src_ip Country | sort - "Number of Ports scanned"| join src_ip type=left [| search index=opnsense sourcetype="opnsense:filterlog" action=pass src_ip!=192.168.0.0/16 | eval Allowed_Traffic=if(in(action, "pass"),"Yes","No") | table Allowed_Traffic src_ip] | fillnull value=No Allowed_Traffic