Intrusion Prevention works in either Detect or Prevent mode. To avoid false positive or accidental blocking of normal traffic, it is recommended to use a Detect Mode First upon application of the rule.

• Detect: Intrusion Prevention uses rules to detect matching traffic and generate events but does not block traffic. Detect mode is useful to test that Intrusion Prevention rules do not interfere with legitimate traffic.
• Prevent: Intrusion Prevention uses rules to detect matching traffic, generate events, and block traffic to prevent attacks.

When you see an action on the logs that says, "Detect Only: Reset", it means that the Intrusion Prevention System (IPS) mode is in Detect only and the supposed action is to reset the traffic. Once you have confirmed that the traffic is not false positive, you can use Prevent mode to enforce the rules.