This article explains the destination IP address matching condition of the SRX security IDP policy when static NAT is in use.

The security policy will match the post-translated destination IP address when static NAT is in use. However, security IDP policy will match the pre-translation destination IP address which is different from security policy.

Topology:

static {
    rule-set 1 {
        from zone trust;
        rule 1 {
            match {
                destination-address 192.168.4.10/32;  <-- here, IDP policy will match it
            }
            then {
                static-nat {
                    prefix {
                        192.168.8.2/32;  <-- here, Security policy will match it
                    }
                }
            }
        }
    }

idp-policy IDPTEST1 {
    rulebase-ips {
        rule A {
            match {
                from-zone any;
                source-address any;
                to-zone untrust;
                destination-address 192.168.8.2/32;
                application default;
                attacks {
                    predefined-attacks [ ICMP:INFO:ECHO-REQUEST ICMP:INFO:ECHO-REPLY ];
                }
            }
            then {
                action {
                    drop-packet;
                }
                notification {
                    log-attacks;
                }
            }
        }
        rule B {
            match {
                from-zone any;          
                source-address any;
                to-zone untrust;
                destination-address 192.168.4.10/32;  
                application default;
                attacks {
                    predefined-attacks [ ICMP:INFO:ECHO-REQUEST ICMP:INFO:ECHO-REPLY ];
                }
            }
            then {
                action {
                    drop-packet;
                }
                notification {
                    log-attacks;
                }
            }
        }
    }
}

Nov 21 10:11:51  SCPS-OBIC-FW01 RT_IDP: IDP_ATTACK_LOG_EVENT: IDP: at 1574298711, SIG Attack log <192.168.4.1/6->192.168.4.10/7577> for ICMP protocol and service SERVICE_IDP application ICMP-ECHO by rule 2 of rulebase IPS in policy IDPTEST1. attack: id=9026, repeat=0, action=DROP_PACKET, threat-severity=INFO, name=ICMP:INFO:ECHO-REQUEST, NAT <0.0.0.0:0->192.168.8.2:0>, time-elapsed=0, inbytes=0, outbytes=0, inpackets=0, outpackets=0, intf:trust:ge-0/0/0.0->untrust:ge-0/0/1.0, packet-log-id: 0, alert=no, username=N/A, roles=N/A and misc-message -

This behavior is normal and by design.