One arm sniffer filtering

[Kenundrum]

I have a one arm sniffer configured on a fortigate and it works quite well. The only problem is that is detecting vulnerability scans as intrusion attempts. The filters appear to operate in a whitelist only mode. Scan traffic to/from these hosts/ports/vlans etc, drop everything else. Is there a way to blacklist? I want to configure the filter to sniff and scan everything EXCEPT a certain host. There has to be a better way than doing something along the lines of filter 1.1.1.1-10.10.10.9,10.10.10.11-254.254.254.254 (thus excluding 10.10.10.10 for example)