Threat action override. For some threat types, only a subset of actions applies. Possible values are: ALERT, ALLOW, DEFAULT_ACTION, DENY.
ALERT
ALLOW
DEFAULT_ACTION
DENY
Required protocol to match. Possible values are: SMTP, SMB, POP3, IMAP, HTTP2, HTTP, FTP.
SMTP
SMB
POP3
IMAP
HTTP2
HTTP
FTP