Struct ManagerConfig 

pub struct ManagerConfig {

    pub shared_threshold: usize,
    pub rotation_window: Duration,
    pub rotation_threshold: usize,
    pub scan_interval: Duration,
    pub background_scanning: bool,
    pub track_combined: bool,
    pub shared_confidence: f64,
    pub attack_sequence_min_ips: usize,
    pub attack_sequence_window: Duration,
    pub auth_token_min_ips: usize,
    pub auth_token_window: Duration,
    pub behavioral_min_ips: usize,
    pub behavioral_min_sequence: usize,
    pub behavioral_window: Duration,
    pub timing_min_ips: usize,
    pub timing_bucket_ms: u64,
    pub timing_min_bucket_hits: usize,
    pub timing_window: Duration,
    pub network_min_ips: usize,
    pub network_check_subnet: bool,
    pub graph_min_component_size: usize,
    pub graph_max_depth: usize,
    pub graph_edge_ttl: Duration,
    pub auto_mitigation_enabled: bool,
    pub auto_mitigation_threshold: f64,
}

Configuration for the campaign manager.

Controls detector thresholds, timing windows, and background scanning behavior.

Fields

shared_threshold: usize

Minimum IPs sharing fingerprint to form campaign (shared FP detector).

Default: 3

rotation_window: Duration

Time window for rotation detection.

Default: 60 seconds

rotation_threshold: usize

Minimum fingerprints for rotation detection.

Default: 3

scan_interval: Duration

How often to run full detector scans.

Default: 5 seconds

background_scanning: bool

Enable background scanning.

When enabled, a background worker periodically runs detection cycles. Default: true

track_combined: bool

Track combined fingerprints (JA4+JA4H) in rotation detector.

Default: true

shared_confidence: f64

Base confidence for shared fingerprint detections.

Default: 0.85

attack_sequence_min_ips: usize

Minimum IPs sharing same payload to trigger detection.

Default: 2

attack_sequence_window: Duration

Time window for attack sequence correlation.

Default: 300 seconds (5 minutes)

auth_token_min_ips: usize

Minimum IPs sharing token structure to trigger detection.

Default: 2

auth_token_window: Duration

Time window for auth token correlation.

Default: 600 seconds (10 minutes)

behavioral_min_ips: usize

Minimum IPs with same behavior pattern.

Default: 2

behavioral_min_sequence: usize

Minimum sequence length to consider for behavioral analysis.

Default: 3

behavioral_window: Duration

Time window for behavioral pattern observation.

Default: 300 seconds (5 minutes)

timing_min_ips: usize

Minimum IPs with synchronized timing.

Default: 3

timing_bucket_ms: u64

Time bucket size for synchronization detection in milliseconds.

Default: 100ms

timing_min_bucket_hits: usize

Minimum requests in same bucket to consider correlated.

Default: 5

timing_window: Duration

Time window for timing analysis.

Default: 60 seconds

network_min_ips: usize

Minimum IPs in same network segment.

Default: 3

network_check_subnet: bool

Enable subnet-based correlation (/24 for IPv4).

Default: true

graph_min_component_size: usize

Minimum connected component size.

Default: 3

graph_max_depth: usize

Maximum traversal depth.

Default: 3

graph_edge_ttl: Duration

Edge TTL.

Default: 3600 seconds

auto_mitigation_enabled: bool

Enable automated mitigation (blocking) of high-confidence campaigns.

Default: false

auto_mitigation_threshold: f64

Confidence threshold for automated mitigation (0.0 - 1.0).

Default: 0.90

Implementations

impl ManagerConfig

pub fn new() -> Self

Create a new configuration with default values.

pub fn with_shared_threshold(self, threshold: usize) -> Self

Builder method to set shared threshold.

pub fn with_rotation_window(self, window: Duration) -> Self

Builder method to set rotation window.

pub fn with_rotation_threshold(self, threshold: usize) -> Self

Builder method to set rotation threshold.

pub fn with_scan_interval(self, interval: Duration) -> Self

Builder method to set scan interval.

pub fn with_background_scanning(self, enabled: bool) -> Self

Builder method to enable/disable background scanning.

pub fn with_track_combined(self, enabled: bool) -> Self

Builder method to enable/disable combined fingerprint tracking.

pub fn with_shared_confidence(self, confidence: f64) -> Self

Builder method to set shared confidence.

pub fn with_auto_mitigation(self, enabled: bool) -> Self

Builder method to enable/disable automated mitigation.

pub fn with_auto_mitigation_threshold(self, threshold: f64) -> Self

Builder method to set automated mitigation threshold.

pub fn validate(&self) -> Result<(), String>

Validate the configuration.

Returns an error message if configuration is invalid.

Trait Implementations

impl Clone for ManagerConfig

fn clone(&self) -> ManagerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ManagerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ManagerConfig

fn default() -> Self

Returns the “default value” for a type.