netapp_ontap.models.anti_ransomware_volume API documentation
Description: Copyright &copy; 2026 NetApp Inc. All rights reserved …

# Module `netapp_ontap.models.anti_ransomware_volume`

Copyright © 2026 NetApp Inc. All rights reserved.

This file has been automatically generated based on the ONTAP REST API documentation.

## Classes

`class AntiRansomwareVolumeSchema (*, only: types.StrSequenceOrSet | None = None, exclude: types.StrSequenceOrSet = (), many: bool | None = None, context: dict | None = None, load_only: types.StrSequenceOrSet = (), dump_only: types.StrSequenceOrSet = (), partial: bool | types.StrSequenceOrSet | None = None, unknown: str | None = None)`

  The fields of the AntiRansomwareVolume object

  ### Ancestors

  - netapp_ontap.resource.ResourceSchema
  - marshmallow.schema.Schema
  - marshmallow.base.SchemaABC
  - abc.ABC

  ### Class variables

  `attack_detected_by: str GET`

    This field specifies whether the attack was reported by `File Analysis` or `Encrypted data percentage analysis`.

    Valid choices:

    - file_analysis
    - encryption_percentage_analysis
  `attack_detection_parameters: AntiRansomwareVolumeAttackDetectionParameters GET POST PATCH`

    The attack_detection_parameters field of the anti_ransomware_volume.

  `attack_probability: str GET`

    Probability of a ransomware attack.
    `none` No suspected ransomware activity.
    `low` Minimally suspected ransomware activity.
    `moderate` Moderately suspected ransomware activity.
    `high` Significantly suspected ransomware activity.

    Valid choices:

    - none
    - low
    - moderate
    - high
  `attack_reports: List[AntiRansomwareAttackReport] GET`

    The attack_reports field of the anti_ransomware_volume.

  `block_device_detection_start_time: ImpreciseDateTime GET`

    This field specifies the block device evaluation start time.

  `block_device_detection_state: str GET`

    This field specifies the block device attack detection status.
    `evaluation_period` Attack detection is currently in its evaluation phase.
    `active_unsuitable_workload` Attack detection is active, but the current workload is not suitable for Anti-ransomware protection.
    `active_suitable_workload` Attack detection is active, and the current workload is appropriate for Anti-ransomware protection.

    Valid choices:

    - evaluation_period
    - active_unsuitable_workload
    - active_suitable_workload
  `clear_suspect: AntiRansomwareVolumeClearSuspect GET POST PATCH`

    Clear suspect status.

  `dry_run_start_time: ImpreciseDateTime GET`

    Time when anti-ransomware monitoring `state` is set to dry-run value for starting evaluation mode.This field will no longer be supported in a future release.

  `event_log: AntiRansomwareVolumeEventLog GET POST PATCH`

    The event_log field of the anti_ransomware_volume.

  `space: AntiRansomwareVolumeSpace GET`

    The space field of the anti_ransomware_volume.

  `state: str GET POST PATCH`

    Anti-ransomware state.
    `disabled` Anti-ransomware monitoring is disabled on the volume. This is the default state in a POST operation.
    `disable_in_progress` Anti-ransomware monitoring is being disabled and a cleanup operation is in effect. Valid in GET operation.
    `dry_run` Anti-ransomware monitoring is enabled in the evaluation mode.
    `enabled` Anti-ransomware monitoring is active on the volume.
    `paused` Anti-ransomware monitoring is paused on the volume.
    `enable_paused` Anti-ransomware monitoring is paused on the volume from its earlier enabled state. Valid in GET operation.
    `dry_run_paused` Anti-ransomware monitoring is paused on the volume from its earlier dry_run state. Valid in GET operation.
    For POST, the valid Anti-ransomware states are only `disabled`, `enabled` and `dry_run`, whereas for PATCH, `paused` is also valid along with the three valid states for POST.

    Valid choices:

    - disabled
    - disable_in_progress
    - dry_run
    - enabled
    - paused
    - enable_paused
    - dry_run_paused
  `surge_as_normal: bool GET POST PATCH`

    Indicates whether or not to set the surge values as historical values. This field is no longer supported. Use update_baseline_from_surge instead.

  `surge_usage: AntiRansomwareVolumeSurgeUsage GET`

    Usage values of the volume's workload during surge. This object is no longer supported use surge_statistics instead.

  `suspect_files: List[AntiRansomwareVolumeSuspectFiles] GET`

    The suspect_files field of the anti_ransomware_volume.

  `typical_usage: AntiRansomwareVolumeTypicalUsage GET`

    Typical usage values of volume workload. This object is no longer supported use historical_statistics instead.

  `update_baseline_from_surge: bool GET POST PATCH`

    Sets the observed surge value as the new baseline on a volume.

  `workload: AntiRansomwareVolumeWorkload GET POST PATCH`

    The workload field of the anti_ransomware_volume.