wrt to jason's comments it is indeed remarkable that you have created a NGFW IPS that has so little impact on through traffic. Im sure it helps that you have split the traffic up into lower order which could get blocked first and upper level which get checked second.