reporting send/receive mail error as Intrusion attacks on firewall

please post the IPS alert so we can see what ID is detected there. you can hide your internal IPs.the remote server should be visible

also it would be helpful to know which technique is used to sync mails. is it IMAP? which port used?

thank you for replying. I found the solution to my question.
I contacted the place where we got the mail service and we deleted the threatening mail address from their server and the problem was fixed.
because the e-mail address was meaninglessly trying to receive 1.5MB files. it was like a bug.
Thank you again for your interest.

so it was actually malware contained in one mail that hit IPS while transferring this particular mail?

I have no clear information about it. It may be in a pending email. because it could not send/receive.

may be suspended mail