ASM don't block XSS

How is that string being passed to the application? Is it via form input? Does that form input have parameters which are defined in the policy? If so, are XSS attack signatures applied to the parameter, and is the parameter enforced or in staging? Also, verify that the request is passing through the virtual server. It's possible that random tags, such as your first </script> example are not perceived as threats because a closing tag such as that, by itself, is not a threat.