Implement reversible Sentinel beta foundation

src/OCSentinelCli/Models.cs

@@ -104,6 +104,8 @@ internal sealed record ScanResult
 
     public VulnerabilityCorrelationSummary VulnerabilityCorrelation { get; init; } = new();
 
+    public RansomwareBetaSummary RansomwareBeta { get; init; } = new();
+
     public ScanRuntimeMetadata Runtime { get; init; } = new();
 
     public List<AttackEvent> Events { get; init; } = [];
@@ -113,6 +115,36 @@ internal sealed record ScanResult
     public List<string> Errors { get; init; } = [];
 }
 
+internal sealed record RansomwareBetaSummary
+{
+    public bool Enabled { get; init; }
+
+    public string State { get; init; } = "disabled";
+
+    public string Reason { get; init; } = "Ransomware beta is disabled.";
+
+    public int LookbackMinutes { get; init; }
+
+    public List<RansomwareSignal> Signals { get; init; } = [];
+}
+
+internal sealed record RansomwareSignal
+{
+    public DateTimeOffset Timestamp { get; init; }
+
+    public string Category { get; init; } = string.Empty;
+
+    public string Confidence { get; init; } = string.Empty;
+
+    public string Process { get; init; } = string.Empty;
+
+    public string Source { get; init; } = string.Empty;
+
+    public long EventId { get; init; }
+
+    public string Evidence { get; init; } = string.Empty;
+}
+
 internal sealed record NinjaOneContext
 {
     public string OrganizationId { get; init; } = string.Empty;