Suricata

In IPS mode, when there are no rules except for an alert rules, traffic is "passed" (allowed implicitly/passively by default) but the verdict is "alert"

It seems like verdict should report on what the final traffic action was, in this case "pass"

It would also be very helpful is the verdict output showed which sid took the action against the traffic. For example:

"verdict": {
"action": "pass"
"sid": "1234"
},

And maybe the implicit/default/passive pass action might generate a log entry like:

"verdict": {
"action": "pass"
"sid": "default"
},