- Added rule_response_action to Ransomware Activity alerts, exposing a terminate_sessions field that shows if Box Shield terminated the user’s sessions
- terminate_sessions reflects the Admin Console “Terminate Target User Sessions” rule (off by default)
- Other Shield alerts (Anomalous Download, Malicious Content, Suspicious Session) still return null for rule_response_action