netapp_ontap.models.anti_ransomware_volume_attack_detection_parameters API documentation
Description: Copyright &copy; 2026 NetApp Inc. All rights reserved …

# Module `netapp_ontap.models.anti_ransomware_volume_attack_detection_parameters`

Copyright © 2026 NetApp Inc. All rights reserved.

This file has been automatically generated based on the ONTAP REST API documentation.

## Classes

`class AntiRansomwareVolumeAttackDetectionParametersSchema (*, only: types.StrSequenceOrSet | None = None, exclude: types.StrSequenceOrSet = (), many: bool | None = None, context: dict | None = None, load_only: types.StrSequenceOrSet = (), dump_only: types.StrSequenceOrSet = (), partial: bool | types.StrSequenceOrSet | None = None, unknown: str | None = None)`

  The fields of the AntiRansomwareVolumeAttackDetectionParameters object

  ### Ancestors

  - netapp_ontap.resource.ResourceSchema
  - marshmallow.schema.Schema
  - marshmallow.base.SchemaABC
  - abc.ABC

  ### Class variables

  `based_on_file_create_op_rate: bool GET POST PATCH`

    Specifies whether attack detection is based on the file create operations rate. This parameter is valid only for NAS volumes.

  `based_on_file_delete_op_rate: bool GET POST PATCH`

    Specifies whether attack detection is based on the file delete operations rate. This parameter is valid only for NAS volumes.

  `based_on_file_rename_op_rate: bool GET POST PATCH`

    Specifies whether attack detection is based on the file rename operations rate. This parameter is valid only for NAS volumes.

  `based_on_high_entropy_data_rate: bool GET POST PATCH`

    Specifies whether a high entropy data rate should be considered for attack detection.

  `based_on_never_seen_before_file_extension: bool GET POST PATCH`

    Specifies whether file extensions never seen before should be considered for attack detection.

  `block_device_auto_learned_encryption_threshold: Size GET POST PATCH`

    Specifies the block device auto learned encryption threshold.

  `file_create_op_rate_surge_notify_percent: Size GET POST PATCH`

    Specifies the percentage of surge in the file create rate up to which it is considered normal behavior.

    Example: 100

  `file_delete_op_rate_surge_notify_percent: Size GET POST PATCH`

    Specifies the percentage of surge in the file delete rate up to which it is considered normal behavior.

  `file_rename_op_rate_surge_notify_percent: Size GET POST PATCH`

    Specifies the percent of surge in the file rename rate up to which it is considered normal behavior.

  `high_entropy_data_surge_notify_percent: Size GET POST PATCH`

    Specifies the percentage of surge in high entropy data up to which it is considered as normal behavior. For example, if the usual high entropy data rate in the volume is 5% and if this parameter is set to 100%, it will be considered as an unusual surge if the high entropy data rate of the volume exceeds 10% at any time. Similarly, if this parameter is set to 400%, it will be considered as an unusual surge if the high entropy data rate of the volume exceeds 25%, and so on.

  `never_seen_before_file_extension_count_notify_threshold: Size GET POST PATCH`

    Specifies the number of files found with a never seen before file extension up to which it is considered normal behavior.

  `never_seen_before_file_extension_duration_in_hours: Size GET POST PATCH`

    Specifies the duration within which the specified number of files found with never seen before file extensions is considered normal behavior.

  `relaxing_popular_file_extensions: bool GET POST PATCH`

    Specifies whether popular file extensions should be relaxed from being treated as a suspect for the attack. Some popular file extensions are .txt, .pdf, and so on.