Add passive file churn sensor beta

src/OCSentinelCli/Models.cs

@@ -119,6 +119,8 @@ internal sealed record RansomwareBetaSummary
 {
     public bool Enabled { get; init; }
 
+    public bool AlertingEnabled { get; init; }
+
     public string State { get; init; } = "disabled";
 
     public string Reason { get; init; } = "Ransomware beta is disabled.";
@@ -128,6 +130,38 @@ internal sealed record RansomwareBetaSummary
     public List<RansomwareSignal> Signals { get; init; } = [];
 
     public List<RansomwareSmbSession> SmbSessions { get; init; } = [];
+
+    public RansomwareFileChurnSummary FileChurn { get; init; } = new();
+}
+
+internal sealed record RansomwareFileChurnSummary
+{
+    public bool Enabled { get; init; }
+
+    public bool DataAvailable { get; init; }
+
+    public bool IsTruncated { get; init; }
+
+    public int WindowMinutes { get; init; }
+
+    public int FileOperationCount { get; init; }
+
+    public int DeleteOperationCount { get; init; }
+
+    public int WriteOperationCount { get; init; }
+
+    public int DistinctProcessCount { get; init; }
+
+    public List<RansomwareFileChurnProcess> TopProcesses { get; init; } = [];
+}
+
+internal sealed record RansomwareFileChurnProcess
+{
+    public string Process { get; init; } = string.Empty;
+
+    public int DeleteOperationCount { get; init; }
+
+    public int WriteOperationCount { get; init; }
 }
 
 internal sealed record RansomwareSmbSession