This article explains the SRX security IDP policy rules matching conditions when source NAT is in use.

Security IDP policy will match the pre-translation source IP address even IDP policy is after SNAT in the flow process.

Topology:

source {
    rule-set 1 {
        from zone trust;
        to zone untrust;
        rule 1 {
            match {
                source-address 0.0.0.0/0;
                destination-address 0.0.0.0/0;
            }
            then {
                source-nat {
                    interface;
                }
            }
        }
    }
}

idp-policy IDPTEST1 {
    rulebase-ips {
        rule A {
            match {
                from-zone trust;
                source-address 192.168.4.1/32;  <<Pre-translation source address
                to-zone any;
                destination-address any;
                application default;
                attacks {
                    predefined-attacks [ ICMP:INFO:ECHO-REQUEST ICMP:INFO:ECHO-REPLY ];
                }
            }
            then {
                action {
                    drop-packet;
                }
                notification {
                    log-attacks;
                }
            }
        }
        rule B {                        
            match {
                from-zone trust;
                source-address 192.168.8.1/32;  <<Post-translated source address
                to-zone any;
                destination-address any;
                application default;
                attacks {
                    predefined-attacks [ ICMP:INFO:ECHO-REQUEST ICMP:INFO:ECHO-REPLY ];
                }
            }
            then {
                action {
                    drop-packet;
                }
                notification {
                    log-attacks;
                }
            }
        }
    }
}

Nov 21 10:59:55  SCPS-OBIC-FW01 RT_IDP: IDP_ATTACK_LOG_EVENT: IDP: at 1574301591, SIG Attack log <<span style="color:blue">192.168.4.1/13->192.168.8.2/10586> for ICMP protocol and service SERVICE_IDP application ICMP-ECHO by rule 1 of rulebase IPS in policy IDPTEST1. attack: id=9026, repeat=4, action=DROP_PACKET, threat-severity=INFO, name=ICMP:INFO:ECHO-REQUEST, NAT <192.168.8.1:25936->0.0.0.0:0>, time-elapsed=0, inbytes=0, outbytes=0, inpackets=0, outpackets=0, intf:trust:ge-0/0/0.0->untrust:ge-0/0/1.0, packet-log-id: 0, alert=no, username=N/A, roles=N/A and misc-message -

This behavior is by design.