You need to assign a priority to your alerts so that port scans aren't getting you out of bed.
Assign a custom priority level to an alert using the priority keyword:
The priority keyword only changes the priority of the current rule. It has no effect on any of the other rules.
For example, the following rule assigns a priority of 10 to an attempt to connect to a Telnet server:
alert tcp any any -> any 23 (msg: "Telnet attempt"; priority: 10;)
This has no effect other than marking the rule with a priority in the alert file. This is one of the packets from the previous alert rule:
[**] [1:0:0] Telnet attempt [**] [Priority: 10] 11/02-13:42:39.806893 192.168.0.8:33175->192.168.0.25:23 TCP TTL:64 TOS:0x10 ID:53754 IpLen:20 DgmLen:52 DF ***A***F Seq: 0x1A3A5F77 Ack: 0x28166C84 Win: 0x16D0 TcpLen: 32 TCP Options (3) => NOP NOP TS: 1872654 15987586
You can see that the priority has been set to 10. You can then use this value in your other monitoring programs to determine whether an alert is worth escalating.
Snort Users Manual
Capturing Traffic from a Specific TCP Session
Installing Snort from Source on Unix
Logging to a File Quickly
How to Build Rules
Detecting Stateless Attacks and Stream Reassembly
Managing Snort Sensors
Generating Statistical Output from Snort Logs
Monitoring Network Performance