MAC OS 10.9 Scans w/ Network Threat

Symantec Endpoint 12.1.4 features new Network Threat protection for MAC OSX.  On our MACs this feature is blocking scanning from authorized ACAS servers with  Brute Force Remote Login event for inbound TCP port 22. There is no exception in the list for this event. When we add the IP range of the scanning subnet to the Excluded Hosts list, it has no effect