The question does not specify an order in which the evidence was uncovered, which makes the scenario confusing. I will put this in an order chosen by me so that it makes the most sense:
"An IDS alert is generated due to a signature of a known malware" - this is evidence, but sometimes IDS generates false positive alerts, e.g. due to a user or program doing legitimate activities that look like what the malware does to the IDS, or a bug in the IDS that catches more types of behaviour than intended.
"An alert was found on OSSEC IDS of a host" (seems like the same thing as the above?!)
"An URL was blocked by NGFW which was requested from the possibly infected host." - the fact that the IDS and the firewall both detected malware-like activity and the host matches, means the circumstantial evidence has been corroborated. However, again this could theoretically be a false positive, as e.g. a security professional might be accessing a compromised website with
curl to check what is on it. It's still not direct evidence!
Direct evidence and best evidence:
"The extraction of malware was found on Proxy Server" - this means the actual malware was found. This is direct evidence, and irrefutable proof of (attempted or actual) malware infection. Since from the other evidence we can see it was running, it must have been an actual malware infection.