Analyzing traffic: telling a real block apart from a false positive

A port scan just triggered a Suricata alert. Was it stopped, or only seen going by? The fast.log line does not answer that question. An alert alone proves nothing. Suricata's fast.log format gives a text line with no explicit action…