Suricata

It should be pass, if that's the rule that triggered.
The PASS action is the only one with a different check-style when we log the verdict, so there may be something here.

But more info could be of help, still, indeed.

Removed the Duplicate of #7544 as to me that one has more of a feature request + some considerations on what is understood as `pass` and `accepted` in IPS mode.

Although there may be more to that one -- which means it still requires further investigation, while this could be fixed by what Philippe has patched recently.