{
  "warningEventThreshold": 10,
  "criticalEventThreshold": 30,
  "warningUniqueIpThreshold": 5,
  "criticalUniqueIpThreshold": 12,
  "loginBurstWindowMinutes": 15,
  "warningLoginBurstCount": 5,
  "criticalLoginBurstCount": 20,
  "warningSprayAccountCount": 5,
  "criticalSprayAccountCount": 10,
  "correlationWarningCveThreshold": 1,
  "correlationCriticalCveThreshold": 1,
  "ransomwareBetaEnabled": false,
  "ransomwareBetaAlertingEnabled": false,
  "ransomwareLookbackMinutes": 15,
  "ransomwareWarningSignalCount": 2,
  "ransomwareCriticalSignalCount": 3,
  "ransomwareCaptureSmbSessions": true,
  "ransomwareFileChurnEnabled": false,
  "ransomwareFileChurnWindowMinutes": 15,
  "ransomwareFileChurnWarningDeleteCount": 50,
  "ransomwareFileChurnWarningWriteCount": 250,
  "ransomwareFileChurnCriticalDeleteCount": 200,
  "ransomwareFileChurnCriticalWriteCount": 1000,
  "ransomwareFileChurnMaxAuditEvents": 5000,
  "ransomwareExcludedProcesses": [],
  "ftpRoots": [
    "C:\\inetpub\\logs\\LogFiles",
    "D:\\inetpub\\logs\\LogFiles"
  ],
  "fileZillaRoots": [
    "C:\\Program Files (x86)\\FileZilla Server\\Logs",
    "D:\\Program Files (x86)\\FileZilla Server\\Logs"
  ],
  "excludedIps": [
    "127.0.0.1",
    "::1"
  ]
}