Struct EntityConfig 

pub struct EntityConfig {
    pub max_entities: usize,
    pub max_entities_per_site: usize,
    pub risk_half_life_minutes: f64,
    pub repeat_offender_max_factor: f64,
    pub block_threshold: f64,
    pub max_rules_per_entity: usize,
    pub enabled: bool,
    pub max_risk: f64,
    pub max_anomalies_per_entity: usize,
}

Configuration for entity tracking.

Fields

max_entities: usize

Maximum number of entities to track (LRU eviction when exceeded).

max_entities_per_site: usize

Maximum entities per site/tenant (prevents single tenant from filling global pool).

SECURITY: This limit ensures fair-share allocation across tenants. A single tenant generating many unique actors (intentional attack or misconfigured client) cannot fill the global pool and degrade security for other tenants.

Default: 10% of max_entities (10,000 for default 100,000 max) Set to 0 to disable per-site limits.

risk_half_life_minutes: f64

Risk half-life in minutes (time for risk to decay to 50% of current value).

SECURITY: Using exponential decay prevents attackers from predicting when their risk score will drop below threshold. With linear decay (deprecated), attackers could time attacks to occur right after score drops below threshold.

Formula: new_risk = old_risk * 0.5^(elapsed_minutes / half_life_minutes)

Default: 5 minutes (score decays to 50% every 5 minutes)

• After 5 min: 50% of original
• After 10 min: 25% of original
• After 20 min: 6.25% of original

repeat_offender_max_factor: f64

Minimum half-life for repeat offenders (multiplied from base).

Entities with many rule matches decay slower as punishment. Applied as: effective_half_life = base_half_life * repeat_offender_factor

Default factor range: 1.0 (first offense) to 3.0 (heavy offender)

block_threshold: f64

Risk threshold for automatic blocking.

max_rules_per_entity: usize

Maximum number of rule matches to track per entity.

enabled: bool

Whether entity tracking is enabled.

max_risk: f64

Maximum risk score (default: 100.0, extended: 1000.0).

max_anomalies_per_entity: usize

Maximum number of anomaly entries to track per entity.

Trait Implementations

impl Clone for EntityConfig

fn clone(&self) -> EntityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EntityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EntityConfig

fn default() -> Self

Returns the “default value” for a type.