Match the action to the stage of the web attack