By default Suricata is configured to run as an Intrusion Detection System (IDS), which only generates alerts and logs suspicious traffic. When you enable IPS mode, Suricata can actively drop suspicious network traffic in addition to generating alerts for further analysis.
How To Configure Suricata as an Intrusion Prevention System (IPS) on Debian 11
How To Configure Suricata as an Intrusion Prevention System (IPS) on Rocky Linux 8
How To Configure Suricata as an Intrusion Prevention System (IPS) on Ubuntu 20.04