Add passive file churn sensor beta

2026-08-01 01:15:40 +02:00
parent 22be9689e2
commit 8407d0c5b2
13 changed files with 468 additions and 14 deletions
--- a/config/ocsentinel-settings.example.json
+++ b/config/ocsentinel-settings.example.json
@@ -11,10 +11,18 @@
  "correlationWarningCveThreshold": 1,
  "correlationCriticalCveThreshold": 1,
  "ransomwareBetaEnabled": false,
+  "ransomwareBetaAlertingEnabled": false,
  "ransomwareLookbackMinutes": 15,
  "ransomwareWarningSignalCount": 2,
  "ransomwareCriticalSignalCount": 3,
  "ransomwareCaptureSmbSessions": true,
+  "ransomwareFileChurnEnabled": false,
+  "ransomwareFileChurnWindowMinutes": 15,
+  "ransomwareFileChurnWarningDeleteCount": 50,
+  "ransomwareFileChurnWarningWriteCount": 250,
+  "ransomwareFileChurnCriticalDeleteCount": 200,
+  "ransomwareFileChurnCriticalWriteCount": 1000,
+  "ransomwareFileChurnMaxAuditEvents": 5000,
  "ransomwareExcludedProcesses": [],
  "ftpRoots": [
    "C:\\inetpub\\logs\\LogFiles",