which signature action should be selected

Which signature action should be selected to cause the attacker’s traffic flow to terminate…?