Security Intelligence Does not block sometimes

[Wee2o]

I have created security intelligence block list but sometimes it allows the connections like the one highlighted and it is identified as attackers. 

Is that because the intrusion policy is set to detection not prevention?  

[FredrikW73]

The Reason column seems to indicate that you have set the action to "Monitor-only" and not "Block" for that Security Intelligence category. If so, my understanding is that the result is that no requests are blocked, not even the lower four in your screenshot.

[Wee2o]

The Monitor-Only on the intrusion policy not the security intelligence. will that affect it?

[FredrikW73 · Accepted solution]

Are you talking about the "Drop when inline" setting?

What is the mode of the device and type of interfaces?

This is the setting I mentioned:

[Wee2o]

you are correct, I missed this settings. thank you!