Occurences in ASM reports

Hello,

 

I would like to know how ASM Attack types reports show a lot bigger occurences number than actual blocks are?

 

Does ASM somehow categorize requests to some attack type even if they are legal.

 

Thanks in advance

 

BR

 

Teemu