hanzo_client/models/risk_model_state.rs
1/*
2 * Hanzo Cloud API
3 *
4 * The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
5 *
6 * The version of the OpenAPI document: v1
7 *
8 * Generated by: https://openapi-generator.tech
9 */
10
11use crate::models;
12use serde::{Deserialize, Serialize};
13
14#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
15pub struct RiskModelState {
16 /// Aggregates reports the pressure on this organisation's own sliding aggregates, and whether they have started forgetting subjects to stay inside their bound.
17 #[serde(rename = "aggregates", skip_serializing_if = "Option::is_none")]
18 pub aggregates: Option<Box<models::RiskAggregates>>,
19 /// Blind counts, per feature, how often it took its neutral value for want of data. A feature blind on most traffic is not contributing whatever the inventory claims for it.
20 #[serde(rename = "blind", skip_serializing_if = "Option::is_none")]
21 pub blind: Option<std::collections::HashMap<String, i32>>,
22 /// Cut is the threshold in force, derived from Stated as a quantile of the scores actually observed.
23 #[serde(rename = "cut", skip_serializing_if = "Option::is_none")]
24 pub cut: Option<f64>,
25 /// Descends is the published value the working model grew out of: the newest one whose mass count it has reached or passed. Empty when nothing has been published yet. It is DERIVED from the count and never stored, so an instant rollback is right for free — adopting an older value moves the count backward and this answers with that older value, where a stored pointer would be a second fact to keep in step. Read with Learned it is also the DRIFT: this model is Descends plus however many events the two counts differ by.
26 #[serde(rename = "descends", skip_serializing_if = "Option::is_none")]
27 pub descends: Option<String>,
28 /// Disposed is how many published values retention has taken. It is DERIVED from the lowest surviving sequence, so it cannot drift from what it describes, and it is reported because a retention that binds is a fact an operator must be able to read rather than a silence.
29 #[serde(rename = "disposed", skip_serializing_if = "Option::is_none")]
30 pub disposed: Option<i32>,
31 /// Learned is how many events the model has learned from.
32 #[serde(rename = "learned", skip_serializing_if = "Option::is_none")]
33 pub learned: Option<i32>,
34 /// Live is false while the model is in shadow — scoring, learning and recording what it WOULD have alerted on, and changing no outcome. Shadow is the default for a new tenant.
35 #[serde(rename = "live", skip_serializing_if = "Option::is_none")]
36 pub live: Option<bool>,
37 /// Policy is the version of the decision regime this model is deciding under, from your organisation's own policy history (GET /v1/risk/policy). Every score cites it, so it is the join between a past decision and the appetite that produced its threshold. Zero means no regime has ever been stated and the default posture — shadow — is in force.
38 #[serde(rename = "policy", skip_serializing_if = "Option::is_none")]
39 pub policy: Option<i32>,
40 /// Realised is the share that actually was. Reading it beside Stated is what makes the appetite a measured commitment rather than an intention.
41 #[serde(rename = "realised", skip_serializing_if = "Option::is_none")]
42 pub realised: Option<f64>,
43 /// Refused counts events the model would not score, by reason. None of them was examined; a refusal is counted, never silent.
44 #[serde(rename = "refused", skip_serializing_if = "Option::is_none")]
45 pub refused: Option<std::collections::HashMap<String, i32>>,
46 /// Sample is the share of below-the-line events retained for review, which is how the miss rate is measured rather than assumed.
47 #[serde(rename = "sample", skip_serializing_if = "Option::is_none")]
48 pub sample: Option<f64>,
49 /// Saturated means no threshold can honour the stated appetite because too much of the stream scores in the top bucket, so the model is alerting on nothing — the one state that must never be mistaken for quiet.
50 #[serde(rename = "saturated", skip_serializing_if = "Option::is_none")]
51 pub saturated: Option<bool>,
52 /// Shape is the model's identity, as `<family>:<digest>`: the KIND of model, and that family's own digest over the inventory in order and the detector's geometry parameters. It is what an auditor pins an alert to, because learned state is only meaningful against the space that produced it — and the family leads it because two families' masses are not fitted differently, they are different kinds of number.
53 #[serde(rename = "shape", skip_serializing_if = "Option::is_none")]
54 pub shape: Option<String>,
55 /// Stated is the share of the stream this organisation said may be examined.
56 #[serde(rename = "stated", skip_serializing_if = "Option::is_none")]
57 pub stated: Option<f64>,
58 /// Surface reports what of the tenant's OWN event surface has been folded in.
59 #[serde(rename = "surface", skip_serializing_if = "Option::is_none")]
60 pub surface: Option<Box<models::RiskSurface>>,
61 /// Tenant is the qualified key the model is held under — the brand whose issuer vouched for the caller and the organisation it acts for. It is echoed so a reader can see the answer is its own and not a parameter it passed.
62 #[serde(rename = "tenant", skip_serializing_if = "Option::is_none")]
63 pub tenant: Option<String>,
64 /// Values is your organisation's own published model values, newest first — every state it deliberately named, each addressed by its own content and immutable. This is what PUT /v1/risk/state/model names, so it is reported HERE rather than behind an address of its own: they are part of what a review of one model reads, and a list of names is a few hundred bytes. Compare each one's `shape` with the `shape` above: equal means adopting it restores masses into the space this model already runs, and different means adopting it REPLANTS the model into the space that value describes — which is how the shape a search found becomes the shape you are running. The working model is NOT in it. Publication is a boundary somebody marked; the state between two boundaries is in-process counters, and calling those a value would be a claim about reproducibility that nothing could honour.
65 #[serde(rename = "values", skip_serializing_if = "Option::is_none")]
66 pub values: Option<Vec<models::RiskModelValue>>,
67 /// Warm is whether that is enough for the model to have an opinion at all. Below it the model declines to score, which is an ordinary state and is not a clean bill of health.
68 #[serde(rename = "warm", skip_serializing_if = "Option::is_none")]
69 pub warm: Option<bool>,
70}
71
72impl RiskModelState {
73 pub fn new() -> RiskModelState {
74 RiskModelState {
75 aggregates: None,
76 blind: None,
77 cut: None,
78 descends: None,
79 disposed: None,
80 learned: None,
81 live: None,
82 policy: None,
83 realised: None,
84 refused: None,
85 sample: None,
86 saturated: None,
87 shape: None,
88 stated: None,
89 surface: None,
90 tenant: None,
91 values: None,
92 warm: None,
93 }
94 }
95}
96