Seems like a duplicate of https://forum.suricata.io/t/alert-rules-still-triggering-after-pass-reject-rules/ ?