diff --git a/scripts/base/frameworks/notice/main.zeek b/scripts/base/frameworks/notice/main.zeek index f3bc6bc8df..70c19c5883 100644 --- a/scripts/base/frameworks/notice/main.zeek +++ b/scripts/base/frameworks/notice/main.zeek @@ -44,6 +44,10 @@ export { ## ASCII version of the alarm log is emailed in bulk to the ## address(es) configured in :zeek:id:`Notice::mail_dest`. ACTION_ALARM, + ## Indicates that the notice results in a drop action. A drop + ## action can be nullzero, acld drop or a filter as per + ## configured in :zeek:see:`NetControl::acld_rule_policy`. + ACTION_DROP, }; ## Type that represents a set of actions. diff --git a/scripts/policy/frameworks/notice/actions/drop.zeek b/scripts/policy/frameworks/notice/actions/drop.zeek index 03862bac08..ad86c45a1c 100644 --- a/scripts/policy/frameworks/notice/actions/drop.zeek +++ b/scripts/policy/frameworks/notice/actions/drop.zeek @@ -8,11 +8,6 @@ module Notice; export { - redef enum Action += { - ## Drops the address via :zeek:see:`NetControl::drop_address_catch_release`. - ACTION_DROP - }; - redef record Info += { ## Indicate if the $src IP address was dropped and denied ## network access.