It was first reported as a violation in security events while running in monitor mode and as it's a valid connections, I just added it as a rule.