There’s something wrong with your org if nmap scans trigger alerts/bring down machines. There’s so many rogue devices scanning networks nowadays that’d I’d be surprised if anyone had port scanning enabled in the filters to minimize false positives.