- Added rule_response_action with a terminate_sessions field to Ransomware Activity alerts
- Field reflects the Admin Console setting for terminating target user sessions (off by default)
- Other Shield alerts remain unchanged and documentation has been updated