Occurences in ASM reports

Hello,

I would like to know how ASM Attack types reports show a lot bigger occurences number than actual blocks are?

Does ASM somehow categorize requests to some attack type even if they are legal.

Thanks in advance

BR

Teemu