File Activity and Ransomware

InsightIDR
1

Does anyone have a custom rule to detect mass file modification on a file server?

2

Can’t you accomplish that with a change detection rule based of a saved log query?