Add passive file churn sensor beta

tests/OCSentinelCli.Tests/OCSentinelCli.Tests.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.3">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\OCSentinelCli\OCSentinelCli.csproj" />
+  </ItemGroup>
+</Project>

tests/OCSentinelCli.Tests/RansomwareBetaTests.cs

@@ -0,0 +1,55 @@
+using System.Runtime.Versioning;
+using Xunit;
+
+namespace OCSentinelCli.Tests;
+
+[SupportedOSPlatform("windows")]
+public sealed class RansomwareBetaTests
+{
+    [Fact]
+    public void FileChurnBelowBothThresholdsDoesNotCreateSignal()
+    {
+        var summary = new RansomwareFileChurnSummary
+        {
+            Enabled = true,
+            DataAvailable = true,
+            DeleteOperationCount = 49,
+            WriteOperationCount = 500
+        };
+
+        RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());
+
+        Assert.Null(signal);
+    }
+
+    [Fact]
+    public void CriticalFileChurnCreatesOnlyMediumConfidenceSignal()
+    {
+        var summary = new RansomwareFileChurnSummary
+        {
+            Enabled = true,
+            DataAvailable = true,
+            WindowMinutes = 15,
+            DeleteOperationCount = 200,
+            WriteOperationCount = 1000,
+            DistinctProcessCount = 1,
+            TopProcesses = [new RansomwareFileChurnProcess { Process = "encryptor.exe", DeleteOperationCount = 200, WriteOperationCount = 1000 }]
+        };
+
+        RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());
+
+        Assert.NotNull(signal);
+        Assert.Equal("file-churn-critical", signal.Category);
+        Assert.Equal("medium", signal.Confidence);
+        Assert.Equal("encryptor.exe", signal.Process);
+    }
+
+    [Fact]
+    public void PassiveBetaCannotElevateNinjaAlertState()
+    {
+        var summary = new RansomwareBetaSummary { Enabled = true, State = "critical" };
+
+        Assert.False(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: false));
+        Assert.True(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: true));
+    }
+}