Fluctuating IDS alert - action blocked then allowed

[Essam]

in the Security Center > Event view, I have received many IDS alerts related to the same  threat :

Microsoft Edge Intl.js memory corruption attempt. However this IDS was blocked in all the reported alerts (Whitelist is off), but there were one or two alerts that allowed .see attached screenshot where there are two IDS alerts with similar source and destination only the time differs.

Does that mean the threat at one point was allowed to the network?

[PhilipDAth]

Gave you got the IDS set to prefer security?  I would have expected that to block it?

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Intrus... 

[Bruce]

Did the destination happen to be across an AutoVPN tunnel, and you’re using a full tunnel with this MX as the exit hub? If that’s the case then the IDS/IPS only operates in IDS (i.e. non-blocking mode) for traffic destined across the AutoVPN tunnel. (Reference, https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings, first blue highlighted box).