Struct EntityManager 

pub struct EntityManager { /* private fields */ }

Thread-safe entity manager using DashMap.

Provides lock-free concurrent access to entity state for high-RPS WAF scenarios. Uses timestamp-based LRU eviction instead of ordered list for better concurrency.

SECURITY: Implements per-site entity quotas to prevent a single tenant from filling the global pool and degrading security for all tenants.

Implementations

impl EntityManager

pub fn new(config: EntityConfig) -> Self

Create a new entity manager with the given configuration.

pub fn config(&self) -> &EntityConfig

Get the configuration.

pub fn is_enabled(&self) -> bool

Check if entity tracking is enabled.

pub fn len(&self) -> usize

Get the number of tracked entities.

pub fn is_empty(&self) -> bool

Check if the store is empty.

pub fn metrics(&self) -> EntityMetrics

Get metrics about the entity store.

pub fn touch_entity(&self, ip: &str) -> EntitySnapshot

Touch an entity (update last_seen, apply decay, increment request_count).

Creates the entity if it doesn’t exist. Returns a snapshot of the entity state.

pub fn touch_entity_with_fingerprint( &self, ip: &str, ja4: Option<&str>, combined: Option<&str>, ) -> EntitySnapshot

Touch an entity and associate fingerprint.

pub fn touch_entity_for_site( &self, ip: &str, site_id: &str, ) -> Option<EntitySnapshot>

Touch an entity for a specific site/tenant.

SECURITY: Enforces per-site entity limits to prevent a single tenant from exhausting the global entity pool and degrading security for all tenants.

Returns None if the site has exceeded its quota and the entity doesn’t exist.

pub fn get_site_count(&self, site_id: &str) -> u64

Get the current entity count for a site.

pub fn site_metrics(&self) -> Vec<SiteMetrics>

Get site metrics for monitoring.

pub fn get_entity(&self, ip: &str) -> Option<EntitySnapshot>

Get an entity snapshot (read-only).

pub fn apply_rule_risk( &self, ip: &str, rule_id: u32, base_risk: f64, enable_multiplier: bool, ) -> Option<RiskApplication>

Apply risk from a matched rule.

Returns the risk application result, or None if entity doesn’t exist.

pub fn apply_external_risk(&self, ip: &str, risk: f64, reason: &str) -> f64

Apply external risk (e.g., from anomaly detection).

Creates the entity if it doesn’t exist.

Arguments

• ip - Client IP address
• risk - Risk points to add (will be clamped to max_risk)
• reason - Reason for risk application (logged at debug level)

pub fn apply_anomaly_risk( &self, ip: &str, anomaly_type: &str, risk: f64, details: Option<&str>, ) -> f64

Apply anomaly-based risk to an entity.

Used for behavioral anomalies like honeypot hits, rapid fingerprint changes, etc. Creates the entity if it doesn’t exist.

Arguments

• ip - Client IP address
• anomaly_type - Type of anomaly detected (e.g., “honeypot_hit”, “ja4_rapid_change”)
• risk - Risk points to add
• details - Optional details about the anomaly

pub fn check_block(&self, ip: &str) -> BlockDecision

Check if an entity should be blocked based on risk threshold.

Returns the block decision.

pub fn manual_block(&self, ip: &str, reason: &str) -> bool

Manually block an entity.

pub fn release_entity(&self, ip: &str) -> bool

Release an entity (reset risk and unblock).

pub fn release_all(&self) -> usize

Release all entities (reset risk and unblock all).

Returns the number of entities released.

pub fn list_entity_ids(&self) -> Vec<String>

List all entity IDs.

pub fn list_top_risk(&self, limit: usize) -> Vec<EntitySnapshot>

Returns top N entities sorted by risk score (highest first)

pub fn check_ja4_reputation( &self, ip: &str, current_ja4: &str, now_ms: u64, ) -> Option<Ja4ReputationResult>

Check JA4 reputation for an IP address. Detects rapid fingerprint changes that indicate bot behavior.

Arguments

• ip - Client IP address
• current_ja4 - Current JA4 fingerprint
• now_ms - Current timestamp in milliseconds

Returns

Reputation result if entity exists, None otherwise

pub fn snapshot(&self) -> Vec<EntityState>

Create a snapshot of all entity states for persistence.

Returns a Vec of cloned EntityState suitable for serialization.

pub fn restore(&self, entities: Vec<EntityState>)

Restore entity states from a persisted snapshot.

Clears existing entities and inserts the restored ones. Updates total_created counter to reflect restored count. Rebuilds site_counts from restored entity site_id fields.

pub fn merge_restore(&self, entities: Vec<EntityState>) -> usize

Merge restored entities with existing ones (additive restore).

Only inserts entities that don’t already exist. Useful for partial recovery scenarios. Updates site_counts for newly merged entities.

pub fn clear(&self)

Clear the entity store and all site counts.

Trait Implementations

impl Default for EntityManager

fn default() -> Self

Returns the “default value” for a type.