https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVICA0
"Notice how the rules looks after selecting "Highlight Unused Rules." You can now see exactly what rules have and have not been used since the last reboot."

Configure one of the following Reconnaissance Protection actions for the firewall to take in response to the corresponding reconnaissance attempt: Allow-The firewall allows the port scan or host sweep reconnaissance to continue.
SYN Flood Cookies is also available on DoS Protection Profile, the answer refers to ONLY. DoS Protection profiles protect specific devices (classified profiles) and groups of devices (aggregate profiles) against SYN, UDP, ICMP, ICMPv6, and Other IP flood attacks.
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-zone-protection/reconnaissance-protection.html#ida0512c75-ed54-4b31-8d2c-9f459466d4d2
Port scan protection = Reconnaissance Protection
That can only be done in a Zone Protection Profile. That's meant to be configured on an external-facing interface to protect the entire attack surface.
DOS Protection profiles are meant to be configured on internal-facing interfaces to protect a specific server or group of servers from flood attacks, including SYN Flood.
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-reconnaissance-protection

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFQCA0