export declare interface AdditionalEvidenceRequest {
    ids: string[];
}

export declare interface AdditionalEvidenceResponse {
    request_id: string;
}

export declare class AecontentClientInstance {
    private serviceName;
    constructor();
    /**
     * Get Observation
     * GET
     *
     * @param path string observation path
     * @param timestamp Epoch/Unix Timestamp
     */
    getByPath(path: string, timestamp: number): Promise<any>;
    /**
     * create Tuning rule
     * POST
     *
     * @param accountId string tuning rule's belonging account id
     *
     */
    createRule(accountId: string, data: AlTuningRule): Promise<any>;
    /**
     * delete Tuning rule
     * DELETE
     *
     * @param accountId string tuning rule's belonging account id
     * @param name string tuning rule's name
     *
     */
    deleteRule(accountId: string, name: string): Promise<any>;
    /**
     * Get Tuning rule
     * GET
     *
     * @param accountId string tuning rule's belonging account id
     * @param name string tuning rule's name
     *
     */
    getRule(accountId: string, name: string): Promise<any>;
}

export declare class AegraphClientInstance {
    private serviceName;
    constructor();
    getByRange(cid: number, timestamp: {
        start: number;
        end: number;
    }, filters?: {
        [k: string]: string;
    }): Promise<any>;
}

/**
 * Nothing is complete without at least two aliases
 */
declare const AlAecontentClient: AecontentClientInstance;
export { AlAecontentClient as ALAecontent }
export { AlAecontentClient as AecontentClient }
export { AlAecontentClient }

/**
 * Nothing is complete without at least two aliases
 */
declare const AlAegraphClient: AegraphClientInstance;
export { AlAegraphClient as ALAegraph }
export { AlAegraphClient as AegraphClient }
export { AlAegraphClient }

export declare interface AlIncidentFilterDictionary {
    classifications: {
        [classification: string]: {
            value: string;
            caption: string;
        };
    };
    detectionSources: {
        [detectionSource: string]: {
            value: string;
            caption: string;
        };
    };
    threatLevels: {
        [threatLevel: string]: {
            value: string;
            caption: string;
        };
    };
}

export declare const AlIrisClient: AlIrisClientInstance;

export declare class AlIrisClientInstance {
    defaultIrisType: string[];
    defaultContentType: string[];
    protected serviceName: string;
    private accountDefaultEndpoints;
    constructor();
    /**
     * Fetch the assets elaboration for this incident, if it exists
     * GET
     * /iris/v2/:accountId/:incidentId/elaborations/assets
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/f00b0abab/elaborations/assets"
     */
    getElaborations(accountId: string, incidentId: string, returnValue?: string): Promise<any>;
    /**
     * DSL Translate to al_query
     * POST
     * /iris/v2/incidents/dsl-translate
     * "https://api.cloudinsight.alertlogic.com/iris/v2/incidents/dsl-translate"
     * -d '{"query_string": ["LIKE(Unauthorized),incident.threatRating>High"]}'
     */
    dslTranslate(queryParams: {
        query_string: string[];
    }): Promise<any>;
    /**
     * Get System Constants
     * GET
     * /iris/v2/incidents/helpers
     * "https://api.cloudinsight.alertlogic.com/iris/v2/incidents/helpers"
     */
    getConstants(): Promise<ConstantDefinition>;
    /**
     * Translate search to al_query
     * POST
     * /iris/v2/incidents/translate
     * "https://api.cloudinsight.alertlogic.com/iris/v2/incidents/translate"
     * -d '{"search_request": {...}}'
     */
    searchTranslate(queryParams: {
        search_request: any;
    }): Promise<any>;
    /**
     * Fetch the associated logs/events for this incident
     * GET
     * /iris/v2/:accountId/:incidentId/elaborations/associated
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/f00b0abab/elaborations/associated"
     */
    getAssociatedElaborations(accountId: string, incidentId: string, returnValue?: string): Promise<any>;
    /**
     * Fetch the attatched logs/events for this incident
     * GET
     * /iris/v2/:accountId/:incidentId/elaborations/attached
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/f00b0abab/elaborations/attached"
     */
    getAttatchedElaborations(accountId: string, incidentId: string, returnValue?: string): Promise<any>;
    /**
     * Incident search
     * POST
     * /iris/v2/:account_id/incident/search
     * "https://api.cloudinsight.alertlogic.com/iris/v2/incidents/translate"
     */
    incidentSearch(accountId: string, queryData: IncidentQuery, queryParams?: IncidentQueryParams): Promise<IncidentSearchResponse>;
    /**
     * Fetch an specific incident by id
     * GET
     * /:account_id/:incident_id/incident/fetch
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/f00b0abab/incident/fetch"
     */
    getIncidentById(accountId: string, incidentId: string, returnValue?: string): Promise<any>;
    /**
     * @deprecated use v3 version - getIncidentHistoryV3
     * Fetch incident history for the customer console UI
     * GET
     * /iris/v2/:accountId/:incidentId/incident/log
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/ascads/incident/log"
     */
    getIncidentHistory(accountId: string, incidentId: string): Promise<IncidentHistoryResponse[]>;
    /**
     * Fetch incident history for the customer console UI
     * GET
     * /iris/v2/:accountId/:incidentId/incident/log
     * "https://api.cloudinsight.alertlogic.com/iris/v2/100/ascads/incident/log"
     */
    getIncidentHistoryV3(accountId: string, incidentId: string): Promise<IncidentHistoryResponse[]>;
    /**
     * Get aggregations for a list of fields
     * POST
     * /iris/v2/:account_id/incident/aggregations
     * "https://api.cloudinsight.alertlogic.com/iris/v2/2/incident/aggregations?size=0"
     */
    getAggregationsForFields(accountId: string, filterExpression: any, queryParams?: {
        multi?: boolean;
        size?: number;
        metadata?: boolean;
        raw_totals?: boolean;
    }): Promise<any>;
    getAggregationsForFieldsV3(accountId: string, filterExpression: any, queryParams?: {
        multi?: boolean;
        size?: number;
        metadata?: boolean;
        raw_totals?: boolean;
    }): Promise<any>;
    /**
     * Incident note update
     * PUT
     * /iris/v2/:account_id/:incident_id/incident/note/:note_id
     * "https://api.cloudinsight.alertlogic.com/iris/v1/1234/e7119f0d76d29879/incident/note/234234-23423432-2342343412341234"
     * -d {"note": "This is a note" }
     */
    updateNote(accountId: string, incidentId: string, noteId: string, noteData: {
        note: string;
    }): Promise<any>;
    /**
     * Incident status batch update
     * POST
     * /iris/v2/:account_id/incident/status
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/incident/status"
     * -d '{ "operation": "open", "reason_code": "further_action", "notes": "whatever customer thinks is useful!", "incidents": ["e811af1c88c16a4f"] }'
     */
    incidentStatusBatchUpdate(accountId: string, batchData: IncidentBatchData): Promise<IncidentBatchUpdateResponse>;
    /**
     * List notes on an incident
     * GET
     * /iris/v2/:account_id/:incident_id/incident/note
     * "https://api.cloudinsight.alertlogic.com/iris/v2/1234/e7119f0d76d29879/incident/note"
     */
    getIncidentNoteList(accountId: string, incidentId: string): Promise<IncidentNoteListResponse>;
    /**
     * New incident note
     * POST
     * /iris/v2/:account_id/:incident_id/incident/note
     * "https://api.cloudinsight.alertlogic.com/iris/v2/1234/e7119f0d76d29879/incident/note"
     * -d {"note": "This is a note" }
     */
    newIncidentNote(accountId: string, incidentId: string, noteData: {
        note: string;
    }): Promise<any>;
    /**
     * Perform batch update on incidents feedback
     * POST
     * /iris/v2/:account_id/incident/feedback
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/incident/feedback"
     * -d '{ "operation": "open", "reason_code": "further_action", "notes": "whatever customer thinks is useful!", "incidents": ["e811af1c88c16a4f"] }'
     */
    incidentFeedbackBatchUpdate(accountId: string, batchData: IncidentBatchData): Promise<IncidentBatchUpdateResponse>;
    /**
     * Perform close incident for the customer UI
     * POST
     * /iris/v2/:accountId/:incidentId/incident/close
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/2d3424342/incident/close"
     * -d '{ "reason_code": "further_action",  "notes": "We are done with this" }'
     */
    closeIncident(accountId: string, incidentId: string, closeData: {
        reason_code: string;
        notes: string;
    }): Promise<IncidentStateChangeResponse>;
    /**
     * Reopen an incident in the customer UI
     * POST
     * /iris/v2/:accountId/:incidentId/incident/reopen
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/2d3424342/incident/reopen"
     * -d '{ "notes": "Need to check this out again" }'
     */
    reopenIncident(accountId: string, incidentId: string, reopenData: {
        notes: string;
    }): Promise<IncidentStateChangeResponse>;
    /**
     * Return the actual incident id for a short friendly id
     * GET
     * /iris/v2/:accountId/incident/friendly/:shortIncidentId
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/incident/friendly/asv3s2"
     */
    getIncidentId(accountId: string, shortIncidentId: string): Promise<IncidentIdResponse>;
    /**
     * Snooze a list of incidents in the customer UI
     * POST
     * /iris/v2/:account_id/incident/snooze
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/incident/snooze"
     * -d '{ "period_ms": 1, "reason_code": "tomorrow", "notes": "Snoozed until Bob fixes this", "incidents": ["e811af1c88c16a4f"] }'
     */
    snoozeIncidents(accountId: string, snoozeData: {
        period_ms: number;
        reason_code: string;
        notes: string;
        incidents: string[];
    }): Promise<IncidentBatchUpdateResponse>;
    /**
     * Snooze an incident in the customer UI
     * POST
     * /iris/v2/:account_id/:incident_id/incident/snooze
     * "https://api.cloudinsight.alertlogic.com/iris/v2/19651/2d3424342/incident/snooze"
     * -d '{ "period_ms": 1, "reason_code": "tomorrow", "notes": "Snoozed until Bob fixes this" }'
     */
    snoozeIncident(accountId: string, incidentId: string, snoozeData: {
        period_ms: number;
        reason_code: string;
        notes: string;
    }): Promise<IncidentSnooze>;
    /**
     * Undo cached actions on incidents by token
     * POST
     * /iris/v2/:account_id/incident/undo
     * "https://api.cloudinsight.alertlogic.com/iris/v2/:account_id/incident/undo"
     * -d '{ "performed_by":"John Diaz <jdiaz@alertlogic.com>", "total_updated":1, "update_time":1537804956.345696, \
     * "updates":{ "e81109b776a84ec9":{ "account_id":134232303, "change":{ "new":{ "expiration":1537909356.345745, \
     * "expiration_str":"2018-09-25T21:02:36.345745+00:00", "notes":"Does this work again, testing undo 3!", "period_ms":86400000, \
     * "reactivates_at":"2018-09-25 16:02:36.345745", "reason_code":"next_week", "snooze_by":"John Diaz <jdiaz@alertlogic.com>", \
     * "snoozed":true }, "old":{ "expiration":1537909172.469218, "expiration_str":"2018-09-25T20:59:32.469218+00:00", \
     * "notes":"Does this work again, testing undo 3!", "period_ms":86400000, "reactivates_at":"2018-09-25 15:59:32.469218", \
     * "reason_code":"next_week", "snooze_by":"John Diaz <jdiaz@alertlogic.com>", "snoozed":true } }, \
     * "message":"Updated: snooze_status", "property":"snooze_status" } }}'
     */
    incidentUndoByToken(accountId: string, undoData: UndoDataDefinition): Promise<ConstantTuple[]>;
    /**
     * Retrieves a dictionary of available incident filters and coerces it into a digestible format.
     */
    getIncidentFilterDictionary(): Promise<AlIncidentFilterDictionary>;
    /**
     * Returns the open incidents number related to the correlation id
     */
    getOpenIncidentsByCorrelationId(accountId: string, correlationId: string): Promise<number>;
    getMetadataDictionary(): Promise<MetaDataDictionary>;
    getOneIncidentById(accountId: string, incidentId: string): Promise<any>;
    getIncidentAssetsRaw(accountId: string, incidentId: string): Promise<any>;
    batchUpdate(accountId: string, noun: string, payload: unknown): Promise<any>;
    updateStateBulk(accountId: string, payload: unknown): Promise<any>;
    addFeedbackBulk(accountId: string, payload: unknown): Promise<{
        undo_token: string;
    }>;
    snoozeIncidentsBulk(accountId: string, payload: unknown): Promise<any>;
    undoBulkAction(accountId: string, token: string): Promise<any>;
    translateQueryString(query: string[], aliases?: boolean): Promise<any>;
    getFacts(accountId: string, incidentId: string, observationId: string): Promise<unknown>;
    getNestedEvidences(accountId: string, incidentId: string): Promise<AlObservation[]>;
    getTestIncidentById(accountId: string, incidentId: string): Promise<unknown>;
    getTestIncidentAssetsRaw(accountId: string, incidentId: string): Promise<unknown>;
    getTestIncidentHistory(accountId: string, incidentId: string): Promise<IncidentHistoryResponse[]>;
    retinaSearch(accountId: string, incidentId: string, data: any): Promise<any>;
    testRetinaSearch(accountId: string, incidentId: string, data: any): Promise<any>;
    /**
     * Elaborate additional evidence from a incident
     * POST /iris/v3/{cid}/{incident_id}/additional_evidence
     * @param accountId account id
     * @param incidentId incident id
     * @param data array with the ids of the evidences to elaborate
     */
    elaborateAdditionalEvidence(accountId: string, incidentId: string, data: AdditionalEvidenceRequest): Promise<AdditionalEvidenceResponse>;
    /**
     * Reelaboration status from a incident
     * GET /iris/v3/{cid}/reelaboration_status/{request_id}
     * @param accountId account id
     * @param requestId request id
     */
    reelaborateIncidentStatus(accountId: string, requestId: string): Promise<unknown>;
    /**
     * Get the elaborations that are not flagged
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param elaborationsExcluded array elaborations uuid filter the elaboration not match
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @return Promise with the flagged elaborations
     */
    getElaborationsNoFlagged(accountId: string, incidentId: string, parameters: EvidenceParams, elaborationsExcluded: string[], updateElaboration?: boolean, isTestIncident?: boolean): Promise<Elaboration[]>;
    getFiltersColumns(): Promise<Array<RawFilterColumns>>;
    /**
     * Get the flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param elaborationsIncluded array elaborations uuid filter the elaboration match
     * @return Promise with the flagged elaborations
     */
    getElaborationsFlagged(accountId: string, incidentId: string, parameters: EvidenceParams, elaborationsIncluded: string[], isTestIncident?: boolean): Promise<Elaboration[]>;
    /**
     * Get elaborations total for flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param elaborationsIncluded array elaborations uuid filter the elaboration match
     * @return Promise with the flagged elaborations
     */
    getCountElaborationsFlagged(accountId: string, incidentId: string, elaborationsIncluded: string[], isTestIncident?: boolean): Promise<{
        aggregation?: {
            [i: string]: {
                [j: string]: number;
            };
        };
    }>;
    /**
     * Get elaborations total for not flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param elaborationsExcluded array elaborations uuid filter the elaboration not match
     * @return Promise with the flagged elaborations
     */
    getCountElaborationsNotFlagged(accountId: string, incidentId: string, elaborationsExcluded: string[], isTestIncident?: boolean): Promise<{
        aggregation?: {
            [i: string]: {
                [j: string]: number;
            };
        };
    }>;
    /**
     *  @method getPCAPfile
     *
     *  It gets the PCAP blob file for an event or a list of events
     *
     *  @param {string} accountId
     *  @param {string} incidentId
     *  @param {string[]} uuids List of evidences' ids
     *
     */
    getPCAPfile(accountId: string, incidentId: string, uuids: string[]): Promise<Blob>;
    /**
     * Get the elaborations for Guard Duty Findings
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @return Promise with the flagged elaborations
     */
    getElaborationsGuardDuty(accountId: string, incidentId: string, parameters: any, updateElaboration?: boolean, isTestIncident?: boolean): Promise<Elaboration[]>;
    /**
     * Get the attachments and flagged evidence for a log review incident
     * @param {number} accountId
     * @param {string} incidentId
     * @returns {Promise<any>}
     */
    getAttachments(accountId: string, incidentId: string, isTestIncident?: boolean): Promise<any>;
    /**
     * Get the elaborations by elaboration uuid
     * @param accountId account id
     * @param incidentId incident id
     * @param uuid  elaboration uuid
     * @return observable with the elaboration
     */
    getElaborationById(accountId: string, incidentId: string, uuid: string): Promise<ElaborationEvent | ElaborationLog | ElaborationGuardDuty>;
    downloadAttachment(accountId: string, incidentId: string, messageId: string): Promise<string>;
    /**
     * Build the search to filter elaborations
     * @param search key word to filter the elaborations this ignore case sensitive
     * @param sources sources to filter
     * @param elaborationIncluded array elaborations uuid filter the elaboration match
     * @param elaborationExcluded array elaborations uuid filter the elaboration not match
     * @param evidenceFilter array
     * @param dataType string The data type to request for: 'all', 'iris', 'guardduty'
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @param {Boolean} includedOnly include only the specified elaborationIncluded array.
     * @return Object with the filters
     */
    getElaborationFilter(search: string, sources?: string[], elaborationIncluded?: string[], elaborationExcluded?: string[], evidenceFilter?: any[], dataType?: string, updateElaboration?: boolean, includedOnly?: boolean): RetinaBody;
    /**
     * Build the search to get the aggregation by content type
     * @return Object with the filters
     */
    getElaborationAggregationFilter(elaborationIncluded: string[], elaborationExcluded: string[]): RetinaBody;
    /**
     * Get CSV data from incident list
     * POST
     * /iris/v3/:account_id/csv?multi=true&meta=false&raw_totals=true"
     */
    getCsvIncidentList(accountId: string, filterExpression: any, queryParams?: {
        multi?: boolean;
        size?: number;
        metadata?: boolean;
        raw_totals?: boolean;
    }): Promise<unknown>;
    /**
     * Get csv for all the evidence from a observation grouped by aggregator
     * GET /:incident_id/facts/csv/:path_aggregator
     *  GET   /:incident_id/:observation_id/facts/csv/enrichment_map/:aggregator_path
     */
    getCsvIncidentEvidence(accountId: string, incidentId: string, aggregatorPath: string, observationId?: string): Promise<unknown>;
    renderMarkdown(markdown: string): Promise<any>;
    /**
     * Returns the results of any Search elaborations for an incident
     * GET
     * /iris/v3/:accountId/:incidentId/searches
     * "https://algithub.pd.alertlogic.net/alertlogic/al_iris_py/blob/c7c66bd623962bbc1cb1dab2d8ae20e5606d2018/design/searches/searches.md"
     */
    getSearchElaborations(accountId: string, incidentId: string): Promise<any>;
    /**
     * For HudUI usage specifically
     * Allows for bulk state update operations to be performed against multiple account Ids to their respective default IRIS residency locations
     */
    massUpdate(incidents: {
        accountId: number;
        incidentId: string;
        state: string;
    }[], payload: MassUpdatePayload, updateType: 'state' | 'properties'): Promise<any[]>;
}

export declare const AlIrisClientV3: AlIrisClientV3Instance;

export declare class AlIrisClientV3Instance extends AlIrisClientInstance {
    protected serviceVersion: string;
    super(): void;
    /**
     * Fetch incident history for the customer console UI
     * GET
     * /iris/v3/:accountId/:incidentId/history
     * "https://api.cloudinsight.alertlogic.com/iris/v3/100/ascads/history"
     */
    getIncidentHistory(accountId: string, incidentId: string): Promise<IncidentHistoryResponse[]>;
    /**
     * Get aggregations for a list of fields
     * POST
     * /iris/v3/:account_id/incident/aggregations
     * "https://api.cloudinsight.alertlogic.com/iris/v3/2/incident/aggregations?size=0"
     */
    getAggregationsForFields(accountId: string, filterExpression: any, queryParams?: {
        multi?: boolean;
        size?: number;
        metadata?: boolean;
        raw_totals?: boolean;
    }): Promise<any>;
    /**
     * Retrieves a dictionary of available incident filters and coerces it into a digestible format.
     */
    getIncidentFilterDictionary(): Promise<AlIncidentFilterDictionary>;
    /**
     * Returns the open incidents number related to the correlation id
     */
    getOpenIncidentsByCorrelationId(accountId: string, correlationId: string): Promise<number>;
    getMetadataDictionary(): Promise<MetaDataDictionary>;
    getIncidentById(accountId: string, incidentId: string): Promise<any>;
    getIncidentAssetsRaw(accountId: string, incidentId: string): Promise<any>;
    batchUpdate(accountId: string, noun: string, payload: unknown): Promise<any>;
    updateStateBulk(accountId: string, payload: unknown): Promise<any>;
    addFeedbackBulk(accountId: string, payload: unknown): Promise<{
        undo_token: string;
    }>;
    snoozeIncidentsBulk(accountId: string, payload: unknown): Promise<any>;
    undoBulkAction(accountId: string, token: string): Promise<any>;
    translateQueryString(query: string[], aliases?: boolean): Promise<any>;
    getFacts(accountId: string, incidentId: string, observationId: string): Promise<unknown>;
    getNestedEvidences(accountId: string, incidentId: string): Promise<AlObservation[]>;
    getTestIncidentById(accountId: string, incidentId: string): Promise<unknown>;
    getTestIncidentAssetsRaw(accountId: string, incidentId: string): Promise<unknown>;
    getTestIncidentHistory(accountId: string, incidentId: string): Promise<IncidentHistoryResponse[]>;
    retinaSearch(accountId: string, incidentId: string, data: any): Promise<any>;
    testRetinaSearch(accountId: string, incidentId: string, data: any): Promise<any>;
    /**
     * Elaborate additional evidence from a incident
     * POST /iris/v3/{cid}/{incident_id}/additional_evidence
     * @param accountId account id
     * @param incidentId incident id
     * @param data array with the ids of the evidences to elaborate
     */
    elaborateAdditionalEvidence(accountId: string, incidentId: string, data: AdditionalEvidenceRequest): Promise<AdditionalEvidenceResponse>;
    /**
     * Reelaboration status from a incident
     * GET /iris/v3/{cid}/reelaboration_status/{request_id}
     * @param accountId account id
     * @param requestId request id
     */
    reelaborateIncidentStatus(accountId: string, requestId: string): Promise<unknown>;
    /**
     * re-elaborate incident
     * POST https://$CD15_HOST/iris/v3/{account_id}/reelaborate_observation/{incident_id}
     * @param accountId account id
     * @param incidentId incident id
     */
    reelaborateObservation(accountId: string, incidentId: string): Promise<AdditionalEvidenceResponse>;
    /**
     * Get the elaborations that are not flagged
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param elaborationsExcluded array elaborations uuid filter the elaboration not match
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @return Promise with the flagged elaborations
     */
    getElaborationsNoFlagged(accountId: string, incidentId: string, parameters: EvidenceParams, elaborationsExcluded: string[], updateElaboration?: boolean, isTestIncident?: boolean): Promise<Elaboration[]>;
    getFiltersColumns(): Promise<Array<RawFilterColumns>>;
    /**
     * Get the flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param elaborationsIncluded array elaborations uuid filter the elaboration match
     * @return Promise with the flagged elaborations
     */
    getElaborationsFlagged(accountId: string, incidentId: string, parameters: EvidenceParams, elaborationsIncluded: string[], isTestIncident?: boolean): Promise<Elaboration[]>;
    /**
     * Get elaborations total for flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param elaborationsIncluded array elaborations uuid filter the elaboration match
     * @return Promise with the flagged elaborations
     */
    getCountElaborationsFlagged(accountId: string, incidentId: string, elaborationsIncluded: string[], isTestIncident?: boolean): Promise<{
        aggregation?: {
            [i: string]: {
                [j: string]: number;
            };
        };
    }>;
    /**
     * Get elaborations total for not flagged elaborations
     * @param accountId account id
     * @param incidentId incident id
     * @param elaborationsExcluded array elaborations uuid filter the elaboration not match
     * @return Promise with the flagged elaborations
     */
    getCountElaborationsNotFlagged(accountId: string, incidentId: string, elaborationsExcluded: string[], isTestIncident?: boolean): Promise<{
        aggregation?: {
            [i: string]: {
                [j: string]: number;
            };
        };
    }>;
    /**
     *  @method getPCAPfile
     *
     *  It gets the PCAP blob file for an event or a list of events
     *
     *  @param {string} accountId
     *  @param {string} incidentId
     *  @param {string[]} uuids List of evidences' ids
     *
     */
    getPCAPfile(accountId: string, incidentId: string, uuids: string[]): Promise<Blob>;
    /**
     * Get the elaborations for Guard Duty Findings
     * @param accountId account id
     * @param incidentId incident id
     * @param parameters
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @return Promise with the flagged elaborations
     */
    getElaborationsGuardDuty(accountId: string, incidentId: string, parameters: any, updateElaboration?: boolean, isTestIncident?: boolean): Promise<Elaboration[]>;
    /**
     * Get the attachments and flagged evidence for a log review incident
     * @param {number} accountId
     * @param {string} incidentId
     * @returns {Promise<any>}
     */
    getAttachments(accountId: string, incidentId: string, isTestIncident?: boolean): Promise<any>;
    /**
     * Get the elaborations by elaboration uuid
     * @param accountId account id
     * @param incidentId incident id
     * @param uuid  elaboration uuid
     * @return observable with the elaboration
     */
    getElaborationById(accountId: string, incidentId: string, uuid: string): Promise<ElaborationEvent | ElaborationLog | ElaborationGuardDuty>;
    downloadAttachment(accountId: string, incidentId: string, messageId: string): Promise<string>;
    /**
     * Build the search to filter elaborations
     * @param search key word to filter the elaborations this ignore case sensitive
     * @param sources sources to filter
     * @param elaborationIncluded array elaborations uuid filter the elaboration match
     * @param elaborationExcluded array elaborations uuid filter the elaboration not match
     * @param evidenceFilter array
     * @param dataType string The data type to request for: 'all', 'iris', 'guardduty'
     * @param {Boolean} updateElaboration Ask retina to rebuild Elaboration, used for GD incidents (update=true)
     * @param {Boolean} includedOnly include only the specified elaborationIncluded array.
     * @return Object with the filters
     */
    getElaborationFilter(search: string, sources?: string[], elaborationIncluded?: string[], elaborationExcluded?: string[], evidenceFilter?: any[], dataType?: string, updateElaboration?: boolean, includedOnly?: boolean): RetinaBody;
    /**
     * Build the search to get the aggregation by content type
     * @return Object with the filters
     */
    getElaborationAggregationFilter(elaborationIncluded: string[], elaborationExcluded: string[]): RetinaBody;
    /**
     * Get CSV data from incident list
     * POST
     * /iris/v3/:account_id/csv?multi=true&meta=false&raw_totals=true"
     */
    getCsvIncidentList(accountId: string, filterExpression: any, queryParams?: {
        multi?: boolean;
        size?: number;
        metadata?: boolean;
        raw_totals?: boolean;
    }): Promise<unknown>;
    /**
     * Get csv for all the evidence from a observation grouped by aggregator
     * GET /:incident_id/facts/csv/:path_aggregator
     *  GET   /:incident_id/:observation_id/facts/csv/enrichment_map/:aggregator_path
     */
    getCsvIncidentEvidence(accountId: string, incidentId: string, aggregatorPath: string, observationId?: string): Promise<unknown>;
    renderMarkdown(markdown: string): Promise<any>;
    /**
     * Returns the results of any Search elaborations for an incident
     * GET
     * /iris/v3/:accountId/:incidentId/searches
     * "https://algithub.pd.alertlogic.net/alertlogic/al_iris_py/blob/c7c66bd623962bbc1cb1dab2d8ae20e5606d2018/design/searches/searches.md"
     */
    getSearchElaborations(accountId: string, incidentId: string): Promise<any>;
    /**
     * Returns the manual evidence added to an incident
     * GET
     * /iris/v3/{account_id}/{incident_id}/manual_evidence
     * https://algithub.pd.alertlogic.net/alertlogic/al_iris_py/blob/master/design/searches/searches.md#manual-evidence
     */
    getManualEvidence(accountId: string, incidentId: string): Promise<string[]>;
    /**
     * Add search query events as manual evidence for an incident
     * POST
     * /iris/v3/{account_id}/{incident_id}/manual_evidence
     * https://algithub.pd.alertlogic.net/alertlogic/al_iris_py/blob/master/design/searches/searches.md#manual-evidence
     */
    addManualEvidence(accountId: string, incidentId: string, payload?: {
        ids?: string[];
    }): Promise<{
        incidentId?: string;
        ids: string[];
        errors?: {
            ids: string[];
            reason: string;
        }[];
    }>;
    /**
     * remove search query events that were added as manual evidence for an incident
     * DELETE
     * /iris/v3/{account_id}/{incident_id}/manual_evidence
     * https://algithub.pd.alertlogic.net/alertlogic/al_iris_py/blob/master/design/searches/searches.md#manual-evidence
     */
    removeManualEvidence(accountId: string, incidentId: string, payload?: {
        ids?: string[];
    }): Promise<{
        incidentId?: string;
        ids: string[];
        errors?: {
            ids: string[];
            reason: string;
        }[];
    }>;
}

export declare const AlKalmClient: AlKalmClientInstance;

export declare class AlKalmClientInstance {
    private serviceName;
    private version;
    constructor();
    listCatalogTables(): Promise<StorageDescriptor[]>;
    getCatalogTable(table: string): Promise<StorageDescriptor>;
    startSimpleQuery(accountId: string, namedQuery: string, queryParams?: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * Dumps all data for account_id in csv format in a streaming gzip archive.
     * https://console.product.dev.alertlogic.com/api/kalm/#api-Query-StreamNamedQuery
     * @param accountId Account Id
     * @param namedQuery Name query or table
     * @param queryParams Parameters to filter the query
     * @returns
     */
    queryStream(accountId: string, namedQuery: string, queryParams?: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * Dumps all data for account_id in a streaming csv format.
     * https://console.product.dev.alertlogic.com/api/kalm/#api-Query-StreamNamedQuery
     * @param accountId Account Id
     * @param namedQuery Name query or table
     * @param queryParams Parameters to filter the query
     * @returns
     */
    queryStreamCsv(accountId: string, namedQuery: string, queryParams?: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * /kalm/v1/{account_id}/query/tic_mitre_classification
     * @returns mitre classification
     */
    getMitreClassification(accountId: string): Promise<StandardKalmResponse>;
    /**
     * /kalm/v1/{account_id}/query/dashboards_waf_violations_blocked_attacks
     * @returns blocked attacks
     */
    getBlockedAttacks(accountId: string, queryParams: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * /kalm/v1/{account_id}/query/dashboards_waf_violations_type
     * @returns violations by type
     */
    getViolationsByType(accountId: string, queryParams: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * /kalm/v1/{account_id}/query/dashboards_waf_violations_attack_class
     * @returns blocked attacks
     */
    getViolationsByAttackClass(accountId: string, queryParams: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
    /**
     * /kalm/v1/{account_id}/query/dashboards_waf_violations_destination
     * @returns violations by destination
     */
    getViolationsByDestination(accountId: string, queryParams: SimpleQueryAdditionalParams): Promise<StandardKalmResponse>;
}

export declare class AlObservation {
    evidenceType: string;
    accountId: number;
    aggregations: unknown[];
    authority: string;
    cid: number;
    class: string;
    customerName: string;
    desc: string;
    elaborations: unknown[];
    endTs: number;
    id: string;
    keys: ObservationKeys;
    parents: ObservationParents;
    path: string;
    properties: ObservationProperties;
    recommendations: null;
    scope: ObservationScope;
    severity: string;
    startTs: number;
    subclass: string;
    summary: string;
    time: Date;
    ts: number;
    type: string;
    visibility: string;
    __description: string;
    static import(raw: any): AlObservation;
}

export declare interface AlTuningDetails {
    type: string;
    selector: AlTuningOptionDetails;
    rules: AlTuningOptionDetails[];
    actions: AlTuningOptionDetails[];
}

export declare interface AlTuningOptionDetails {
    func: string;
    args: string[];
}

export declare interface AlTuningRule {
    name: string;
    description?: string;
    tuning: AlTuningDetails;
}

export declare class AttackerLset {
    ip?: string[] | string;
    geo?: Geo[];
    value: string;
    static import(rawData: any): AttackerLset[];
}

export declare interface ConstantDefinition {
    dsl_functions?: any;
    dsl_operators?: ConstantTuple[];
    incident_class_names?: any;
    incident_history_types?: any;
    log_types?: any;
    source_map?: any;
}

/**
 * These are the original typings for responses from the iris service.  They are deprecated/V1 constructs that do not obey current naming conventions.
 * Shame on them.
 */
export declare interface ConstantTuple {
    [index: string]: string;
}

export declare type Criticality = CriticalityLow | CriticalityNeutral | CriticalityHigh | null | 'upgrade' | 'downgrade' | 'none';

export declare type CriticalityHigh = 1;

export declare type CriticalityLow = -1;

export declare type CriticalityNeutral = 0;

export declare class Elaboration extends Evidence {
    uuid: string;
    description: string;
    messageId: string;
    elaborationType: string;
    protocol_decodes: Array<{
        [i: string]: any;
    }>;
    tokens: {
        log_sources?: {
            [i: string]: string;
        };
        parsed_message?: {
            [i: string]: string;
        };
        message_fields?: {
            [i: string]: string;
        };
    };
    rulename: string;
    sourceName: string;
    host_name: string;
    program: string;
    host_id: string;
    appliance: string;
    sourceType: string;
    message: string;
    packetCount: string;
    contentType: string;
    parsed: ParsedData;
    constructor();
    /**
     *  Converts a raw JSON object to an  Elaborations
     *  We recomend validate the object before deserialize
     *  @param {Object} rawData The raw data.
     *
     *  @returns {Elaboration} The interpreted instance object.
     */
    static deserialize(raw: any, type?: EvidenceTypes): Elaboration;
    /**
     *  Validate the minimum field the elaboration should has
     *
     *  @param {Object} rawData The raw data.
     *
     *  @returns {boolean} The interpreted instance object.
     */
    static isValid(raw: any): boolean;
    /**
     *  Converts a raw JSON array object to an array of Elaborations
     *
     *  @param {Array} rawData The raw data.
     *
     *  @returns {Array} The interpreted instance object.
     */
    static deserializeArray(rawData: any[], elaborationType?: EvidenceTypes): Array<Elaboration>;
}

export declare class ElaborationEvent extends Elaboration {
    dst: string;
    event_id: number;
    payload: string[];
    gzipDecode: Array<{
        header: string;
        order?: Array<{
            number: number;
            packet: number;
            type: 'req' | 'res';
        }>;
        value: string;
    }>;
    protocol_decodes: Array<{
        [i: string]: any;
    }>;
    application_payload: string[];
    sig_id: number;
    src: string;
    ts: number;
    snortInfo: {
        al_id: number;
        dest_ip: string;
        dest_port: string;
        protocol: string;
        raw: string;
        revision: string;
        signature_id: string;
        snort_msg: string;
        src_ip: string;
        src_port: string;
    };
    protoFacets: {
        [i: string]: string[];
    };
    ip_proxy: string;
    ip_proxy_client: string;
    constructor();
    static deserialize(raw: any): ElaborationEvent;
}

export declare interface ElaborationForIncTbl extends ElaborationInterface {
    n_ts: number;
    n_pktCnt: number;
    n_ioc: number;
    n_http: number;
    n_sev: number;
    n_conf: number;
}

export declare class ElaborationGuardDuty extends Elaboration {
    rawGuardDutyElaboration: any;
    constructor();
    /**
     * Return the raw data without the fields in the blacklist
     * @param raw {Object} raw data of a guard duty evidence detail
     */
    static cleanGuardDutyRaw(raw: any): any;
    static deserialize(raw: any): ElaborationGuardDuty;
}

export declare interface ElaborationInterface {
    ___incidentId?: string;
    __description: string;
    __normalizedTime?: string;
    __source?: string;
    __uuid: string;
    __messageId?: string;
    id?: {
        account: string;
        aid: string;
        msgid: string;
    };
    customer_id?: number;
    dest_addr?: string;
    eth_dst_addr?: string;
    eth_src_addr?: string;
    ip_chksum?: number[];
    ip_dg_len?: number;
    ip_flags?: number;
    ip_id?: number;
    ip_length?: number;
    ip_offset?: number;
    ip_tos?: number;
    ip_ttl?: number;
    ip_version?: number;
    event_id?: number;
    message?: string;
    payload?: string[];
    protocol_decodes?: {
        [i: string]: any;
    }[];
    repeat_count?: number;
    response_event?: number;
    sensor_id?: number;
    signature_generator?: number;
    signature_id?: number;
    snort_event_id?: number;
    snort_pid?: number;
    snort_reference?: number;
    source_addr?: string;
    __tokens?: Token[];
    ts?: number;
    ts_us?: number;
    pinned: boolean;
    reason: string;
    Analysis?: {
        event_intel: Array<{
            attack: string;
        }>;
    };
    undetected_referrer_samples?: Array<{
        sha256: string;
    }>;
    __snortInfo?: SnortInfo;
    __tessaIntel?: any;
    __criticality: Criticality;
    __appliance_name?: string;
    host?: string;
    dst?: string;
    __packetCount?: number;
    http_code?: number;
    httpResponse?: number;
    Signature?: {
        signature_name: string;
    };
    signature_name?: string;
    verbose_msg?: string;
    rulename?: string;
    source_id?: string;
    src?: string;
    __irisType: string;
    ioc?: any;
    packets?: any;
    __gzipDecode: GzipDecodeRaw[];
    __protoFacets?: {
        dst: string[];
        dstport: string[];
        protocols: string[];
        responseCode: string[];
        src: string[];
        srcport: string[];
    };
    grades?: {
        error?: string;
        kbd_severity?: number;
        kbd_confidence?: number;
    };
    result: string;
    home_net: Homenet[];
}

export declare class ElaborationLog extends Elaboration {
    message: string;
    messageId: string;
    messageCategory: string;
    sourceHostIp: string;
    sourceName: string;
    rulename: string;
    host_id: string;
    tokens_ParsedMessage: {
        [i: string]: unknown;
    };
    tokens_LogSources: {
        [i: string]: unknown;
    };
    constructor();
    static proccessTokens(tokens: any): any[];
    static deserialize(raw: any): ElaborationLog;
}

export declare abstract class Evidence {
    evidenceType: EvidenceTypes | string;
    time: Date;
    notes: any;
    constructor();
    errorStructure(msg: string, raw: any): void;
    /**
     * This function transform the message field in an Array of objects.
     * @param text message to be processed.
     * @returns Array of Objects instance with the message field within.
     */
    wsmSplitData(text: string): Array<{
        key: string;
        value: string;
    }>;
    /**
     * Picking up an element using a criteria search.
     * @param wsmMessageData message data transformed to Array of objects.
     * @param crieteriaSearch key to be selected.
     */
    wsmSelectData(wsmMessageData: Array<{
        key: string;
        value: string;
    }>, crieteriaSearch: string): {
        value: undefined;
        key: undefined;
    } | {
        key: string;
        value: string;
    };
}

export declare interface EvidenceFilter {
    key: string;
    value: string;
}

export declare interface EvidenceParams {
    search: string;
    sourcesFilter: string[];
    evidenceFilter: EvidenceFilter[];
}

export declare type EvidenceTypes = 'unknown' | 'associated log' | 'associated event' | 'guardduty' | 'Flagged Evidence' | 'Incident Audit Trail';

export declare interface FilterItem {
    key: string;
    title: string;
    total: number;
    active?: boolean;
}

export declare class Geo {
    location_ip?: string;
    ip?: string;
    city?: string;
    country?: string;
    countryName?: string;
    latitude?: number;
    longitude?: number;
    postcode?: string;
    regionName?: string;
    static import: (rawData: any) => Geo[];
}

export declare interface GzipDecodeRaw {
    header: string;
    value: string;
    order?: Array<{
        number: number;
        packet: number;
        type: string;
    }>;
}

export declare interface Homenet {
    address: string[];
    host_id: string;
    type: string;
}

export declare class Incident {
    incidentId: string;
    accountId: number;
    friendlyId: string;
    correlationId: string;
    correlationName: string;
    severity: string;
    severityIcon: string;
    customerName: string;
    summary: string;
    attackSummary: string;
    recommendations: string;
    extraRecommendations: string;
    analysis: string;
    observableProxi: string;
    createdOn: Date;
    closedAt: Date;
    createdBy: number;
    detectionSource: string;
    state: string;
    status: string;
    classKey: number | string;
    classDesc: string;
    attackerIp: string;
    attacker_lset: AttackerLset[];
    attackerAny: string[];
    victimIp: string;
    victimInstance: string;
    victimUser: string;
    victim_lset: VictimLset[];
    victimAny: string[];
    notes: any;
    notesCount: number;
    notesLastUpdate: Date;
    updateVersion: number;
    customerStatus: any;
    customerFeedback: any;
    snoozeStatus: any;
    selectedEvent: string[];
    assets: boolean;
    deployment: string;
    region: string;
    vpc: string;
    subnet: string;
    type: string;
    source: string;
    dateRange: string;
    assetType: string;
    assetDeploymentId: string;
    assetDeploymentType: string;
    assetDeploymentInScope: boolean;
    assetsRemediations: Array<{
        key: string;
        name: string;
        type: string;
        url?: string;
    }>;
    assetHostKey: string;
    observable: any;
    associatedEventCount: number;
    associatedLogCount: number;
    findingCount: number;
    flaggedEventCount: number;
    appliances: string[];
    parents?: {
        facts_count: number;
        observations_count: number;
        unelaborated_ids?: string[];
    };
    path: string;
    incident: IncidentProperties;
    automated_response_history?: {
        [key: string]: {
            [key: string]: number;
        };
    };
    mitreClassification?: Array<{
        sub_technique: string;
        tactic: string;
        technique?: string;
    }>;
    geo_ip_map: {
        [key: string]: Geo;
    };
    collectorName: string;
    collectorType: string;
    properties: Properties;
    /**
     *  Return the icon according to the severity level
     *
     *  @param {string} severity.
     *
     *  @returns {string} css class for the icon.
     */
    static getSeverityIcon(severity: string, withColor?: boolean): string;
    /**
     *  Return the background css for a severity
     *
     *  @param {string} severity from defender.
     *
     *  @returns {string} severity in insight.
     */
    static getSeverityColor(severity: string): string;
    /**
     *  Converts a raw JSON object to a structured instance of the Incident class
     *
     *  @param {Object} rawData The raw data.
     *  @param {boolean} strict Whether or not errors with properties should be handled strictly (thrown exception) or leniently (console warning).
     *  @returns {Incident} The interpreted instance object.
     */
    static deserialize(rawData: any, strict?: boolean): Incident;
    /**
     *  Converts a raw JSON array object to an array of Incidents
     *
     *  @param {Array} rawData The raw data.
     *
     *  @returns {Array} The interpreted instance object.
     */
    static deserializeArray(rawData: any[]): Incident[];
    /**
     * Get the selected event ids
     *  @param {Object} raw incident data.
     *
     *  @returns {Array} The list of event ids.
     */
    static getSelectedEvents(rawData: any): string[];
    /**
     * Interface between Iris backend fields and UI Incident Type fields
     * @param irisKey
     */
    getPropertiesFromIrisName(irisKey: string): string | number | string[] | Date | {
        [key: string]: {
            [key: string]: number;
        };
    };
}

export declare interface IncidentBatchData {
    operation?: string;
    reason_code: string;
    notes?: string;
    incidents?: string[];
}

export declare interface IncidentBatchUpdateResponse {
    undo_token?: string;
    updates?: any;
}

export declare class IncidentCard {
    deserialize(incident: Incident): {
        icon: {
            cssClasses: string;
            text: string;
        };
        toptitle: string;
        caption: string;
        subtitle: string;
        properties: Incident;
    };
}

export declare class IncidentGroup {
    groupName: string;
    groupList: Incident[];
    static deserializeIncidentGroups: (raw: any) => IncidentGroup[];
}

export declare interface IncidentHistoryResponse {
    details?: {
        threatRating?: string;
    };
    historyType?: number;
    message?: string;
    time?: number;
    time_str?: string;
    who?: string;
}

export declare interface IncidentIdResponse {
    accountId?: number;
    createTime?: string;
    incidentId?: string;
}

export declare interface IncidentNoteListResponse {
    alertlogic_notes?: any;
    user_notes?: any;
}

declare interface IncidentProperties {
    analyst_assist?: null;
    attackClassId?: number;
    attackClassId_str?: string;
    description?: string;
    escalated?: string;
    escalatedBy?: string;
    escalationTime?: string;
    evolution?: {
        to: {
            alphaId?: string;
            friendlyId: string;
            incidentId: string;
            threatRating: string;
        }[];
        tree: {
            escalated?: boolean;
            escalatedBy?: string;
            friendlyId?: string;
            incidentId?: string;
            summary?: string;
            threatRating?: string;
            evolved_from: {
                at: number;
                incidentId: string;
                friendlyId: string;
                summary: string;
                escalated: boolean;
                escalatedBy: string;
                threatRating: string;
            }[];
        };
    };
    recommendations?: string;
    summary?: string;
    threatRating?: string;
}

export declare interface IncidentQuery {
    query: {
        select: string[];
        where: {
            between: any;
            cidr_match?: string[];
            and?: any;
            or?: any;
            not?: any;
            Comparison_operators?: any;
            in?: any;
        };
        order_by?: string[];
        limit?: number;
    };
}

export declare interface IncidentQueryParams {
    hideChildren?: boolean;
    aid?: string;
    legacyQuery?: string;
    timezone?: string;
    includeEarly?: boolean;
}

export declare interface IncidentSearchIncidentList {
    incident?: {
        [index: string]: string;
    };
    incidentId?: string;
    victim?: {
        account?: string;
        instanceId?: string;
        region?: string;
    };
}

export declare interface IncidentSearchResponse {
    aggregation?: any;
    incidents?: IncidentSearchIncidentList[];
    summary?: IncidentSearchSummaryList;
    summary_by_date_range?: IncidentSearchSummaryRange;
    took?: number;
    total_incidents?: number;
}

export declare interface IncidentSearchSummaryItem {
    count?: number;
    end_date?: string;
    end_timestamp?: number;
    start_date?: string;
    start_timestamp?: number;
    threatRating?: {
        Critical?: number;
        High?: number;
        Info?: number;
        Low?: number;
        Medium?: number;
    };
}

export declare interface IncidentSearchSummaryList {
    affected_hosts_total?: string;
    assets?: {
        deployments?: any;
        regions?: any;
        subnets?: any;
        vpcs?: any;
    };
    category?: any;
    events_sum?: number;
    incidents_completed?: number;
    incidents_open?: number;
    incidents_snoozed?: number;
    sources?: any;
}

export declare interface IncidentSearchSummaryRange {
    last_day?: IncidentSearchSummaryItem;
    last_month?: IncidentSearchSummaryItem;
    last_week?: IncidentSearchSummaryItem;
    this_month?: IncidentSearchSummaryItem;
    this_week?: IncidentSearchSummaryItem;
    today?: IncidentSearchSummaryItem;
}

export declare interface IncidentSnooze {
    notes?: string;
    period_ms?: number;
    reactivates_at?: string;
    reason_code?: string;
    snoozed?: boolean;
    snooze_by?: string;
    user?: string;
    expiration?: number;
    expiration_str?: string;
}

export declare interface IncidentStateChangeResponse {
    new?: {
        notes?: string;
        reason_code?: string;
        status?: string;
        status_change_time?: string;
    };
    old?: {
        status?: string;
        status_change_time?: string;
    };
}

export declare interface IncidentTable {
    events: ElaborationForIncTbl[];
    timespan?: TimeSpanObj;
    msgIds?: {
        [i: string]: boolean;
    };
}

export declare type KalmColum = {
    name: string;
    type: string;
};

export declare type MassUpdatePayload = StateUpdatePayload | PropertiesUpdatePayload;

export declare class MatchCountQueryItem {
    substringi?: RetinaFilterBase;
    substring?: RetinaFilterBase;
    regex?: RetinaFilterBase;
}

export declare interface MetaDataDictionary {
    "incident-class-names": {
        [i: string]: string;
    };
    "incident-history-types": {
        [i: string]: string;
    };
    "log-types": {
        [i: string]: string;
    };
    "sourceMap": {
        [i: string]: string;
    };
}

export declare interface ObservationKeys {
    [key: string]: any & {
        enrichment_map?: {
            [key: string]: string[];
        };
    };
}

export declare interface ObservationParents {
    facts_count: number;
    observations_count: number;
    observation_data?: unknown[];
    facts?: unknown[];
}

export declare interface ObservationProperties {
    asn?: string;
    country: string;
    cwe: string;
    encoding?: string;
    http_element: string;
    ingest_host_id: string;
    ingest_program: string;
    ingest_rule_name: string;
    outcome: string;
    raw_request: string;
    request_id: string;
    rule_confidence: number;
    rule_id: string;
    socket_ip: string;
    src_ip_confidence: number;
    src_type: string;
    src_type_confidence: number;
    uri_path: string;
    violating_element_value: string;
    violation_type: string;
    virtual_host?: string;
    x_forwarded_for: string;
}

export declare interface ObservationScope {
    empty_property?: boolean;
}

export declare interface ParsedData {
    json: {
        [s: string]: any;
    };
    pattern_id: string;
    rule_id: string;
    rule_name: string;
}

export declare interface Properties {
    action?: string;
    anonymous?: boolean;
    asn_org?: string;
    attacker?: string;
    baseline?: Array<any>;
    country?: string;
    event_time?: string;
    geo_data?: {
        title?: string;
        data_types?: Array<{
            color?: string;
            display?: string;
            name?: string;
            shape?: string;
        }>;
        markers?: {
            [key: string]: Array<{
                coords?: Array<number>;
                text?: string;
            }>;
        };
    };
    hosting?: boolean;
    human_time?: string;
    ip_enriched?: boolean;
    isp?: string;
    lat?: number;
    lon?: number;
    map_link?: string;
    mfa?: boolean;
    public_proxy?: boolean;
    queries?: Array<any>;
    tor?: boolean;
    ua_browser?: string;
    ua_device?: string;
    ua_mobile?: boolean;
    ua_os?: string;
    ua_parsed?: boolean;
    user?: string;
    user_desc?: string;
    user_type?: string;
    useragent?: string;
    vpn?: boolean;
}

export declare interface PropertiesUpdatePayload {
    properties: {
        property: string;
        newValue: any;
    }[];
}

/**
 * @file Holds the interfaces for elaborations after it has been "massaged"
 */
export declare interface ProtocolDecode {
    [s: string]: {
        [s: string]: any;
    };
}

export declare interface RawFilterColumns {
    filter_order?: number;
    iris_field_name: string;
    ui_display_name: string;
    use_as_column: boolean;
    use_as_filter: boolean;
    sorted?: boolean;
}

export declare class RetinaBody {
    returnValues?: "*" | string[];
    aggregation?: string[];
    filter?: RetinaFilterOp;
    format?: {
        limit?: number;
        offset?: number;
        order?: {
            by: string;
            direction: 'asc' | 'desc';
        };
    };
    matchCount?: MatchCountQueryItem[];
    raw_totals?: RetinaFilterOp | boolean;
    fields?: SummaryField[];
    group_by?: SearchFilterGroup | {};
}

export declare interface RetinaFilterBase {
    property: string;
    value: string | number;
    decode?: string;
}

export declare type RetinaFilterCollection = RetinaFilterOp[];

export declare type RetinaFilterOp = {
    eq: RetinaFilterBase;
} | {
    and: RetinaFilterCollection;
} | {
    or: RetinaFilterCollection;
} | {
    in: {
        property: string;
        value: string[];
    };
} | {
    not: RetinaFilterOp;
} | {
    exists: {
        property: string;
    };
} | {
    gtTime: RetinaFilterBase;
} | {
    ltTime: RetinaFilterBase;
} | {
    regex: {
        property: string;
        value: string;
        decode?: string;
    };
} | {
    substringi: {
        property: string;
        value: string;
        decode?: string;
    };
} | {
    substring: {
        property: string;
        value: string;
        decode?: string;
        keyencoding?: string;
    };
} | RetinaFilterBase | {};

export declare interface RetinaReturn {
    aggregation?: {
        [s: string]: {
            [s: string]: number;
        };
    };
    filter?: object | string;
    returnVals?: ElaborationInterface[];
    stats?: {
        matchCounts: {
            [i: string]: number[];
        };
        numItemsInDataSource: number;
        numberOfMatchingElaborations: number;
        queryExecutionTime: {
            Aggregation: string;
            Filter: string;
            Hydration: string;
            "Match Counts": string;
            Results: string;
            TimeSlice: string;
            "Total Query": string;
        };
    };
    timeSlice?: object;
    timespan?: any;
}

export declare interface RetinaUrlParams {
    multi?: boolean;
    meta?: boolean;
    raw_totals?: boolean;
    size?: number;
}

/**
 * SearchFilterGroup - Used to structure the filter grouping for advanced search
 *
 * ie.
 * "groupBy": {
 *                "field": "source_keyword",
 *                "sort": ["guardduty", "IDS", "LOG", "MANI", "MANL", "N/A"],
 *                "default": "N/A",
 *                "sub_sort": "incident.begin_time_str:desc"
 *            },
 */
export declare class SearchFilterGroup {
    field: string;
    sort: string;
    default: string;
    sub_sort: string;
    boost: any;
    time_spans: string[];
    /**
     *  Deserialize a raw data entry to build and return a SearchFilterGroup.
     *  @param {string} rawData A raw object containig the filter data grouping - From stored user's filter
     *  @returns SearchFilterGroup An object reflecting a search filter grouping
     */
    static deserialize(rawData: any): SearchFilterGroup;
}

declare interface SimpleQueryAdditionalParams {
    start_time?: string;
    end_time?: string;
    managed_accounts?: string;
}

export declare interface SnortInfo {
    [index: string]: string;
    al_id: string;
    dest_ip: string;
    dest_port: string;
    protocol: string;
    raw: string;
    revision: string;
    signature_id: string;
    snort_msg: string;
    src_ip: string;
    src_port: string;
}

export declare class SourceType {
    static readonly AUDITLOG = "Incident Audit Trail";
    static readonly FLAGGED = "Flagged Evidence";
    static readonly ASSOCLOG = "application/x-alpacket-logmsgs";
    static readonly ASSOCEVENT = "application/x-alpacket-snmsgs";
    static readonly ASSOCWEBEVENT = "application/x-alpacket-wafmsgs";
    static readonly GUARDDUTY = "guardduty";
    static readonly ASSOCLOGMEG = "application/x-alpacket-megmsgs";
    static readonly LOGREVIEWATTACHMENT = "Attachment";
    static readonly LOGREVIEWATTACHMENTFLAGGED = "FlaggedEvidence";
    static readonly ASSOCIDS = "application/x-alpacket-idsmsgs";
    /**
     * Return the source name according the content type
     * @param {string} Content type
     * @return {string} Source name
     */
    static getSourceName(type: string): string;
    /**
     * Return the evidence by content type
     * @param {string} Content type
     * @return {string} Evidence type
     */
    static getType(type: string): string;
}

export declare type StandardKalmResponse = {
    rows: unknown[];
    column_info: KalmColum[];
};

export declare interface StateUpdatePayload {
    newState: {
        "incidentState": string;
        "assignedOperatorId": string;
    };
}

export declare interface StorageDescriptor {
    SortColumns: any;
    Location: string;
    Columns: StorageDescriptorColumn[];
    PartitionKeys: any;
    Name: string;
}

export declare interface StorageDescriptorColumn {
    Type: 'bigint' | 'string' | 'int';
}

export declare interface SummaryField {
    key_name?: string;
    name?: string;
    type?: string;
    sub?: SummaryField[];
    filters?: Array<{
        [i: string]: string | boolean;
    }>;
    time_zone?: string;
    ranges?: Array<{
        to: string;
        from: string;
        key: string;
    }>;
}

export declare interface TimeSpanObj {
    minTicks: number;
    maxTicks: number;
}

export declare interface Token {
    description: string;
    tokenName: string;
    value: string | string[];
}

export declare interface UndoDataDefinition {
    performed_by?: string;
    total_updated?: number;
    update_time?: number;
    updates?: {
        [index: string]: {
            account_id?: string;
            change?: {
                new?: IncidentSnooze;
                old?: IncidentSnooze;
            };
            message?: string;
            property?: string;
        };
    };
}

export declare class VictimLset {
    ip?: string[] | string;
    geo?: Geo[];
    value: string;
    static import(rawData: any): VictimLset[];
}

export { }
