Hi ,
It depends on your current routing . If you have a route with two equal cost next-hops, Junos chooses one of them randomly and installs it in the forwarding table (unless you apply load-balancing) .
Please verity the route for this IP , whatever is the active next-hop, security flow uses that .
>show route A.B.C.D
>show route forwarding-table matching A.B.C.D
In your case packet is coming from 49.196.10.228, so verify the route for this IP , and check the outgoing itnerface (next-hop), It might be ge-0/0/0.0 . That's the reason it is showing incoming interface as ge-0/0/0.0
Hope this helps .