/**
 * SIEM Integration Types
 *
 * TypeScript interfaces and Zod schemas for SIEM integration.
 * Supports Loki (primary, free/self-hosted), Splunk, and Elastic.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
export declare const SIEM_PROVIDERS: readonly ["loki", "splunk", "elastic"];
export type SIEMProvider = (typeof SIEM_PROVIDERS)[number];
export declare const AUTH_TYPES: readonly ["none", "basic", "bearer", "api-key"];
export type AuthType = (typeof AUTH_TYPES)[number];
export declare const SIEMAuthenticationSchema: z.ZodEffects<z.ZodObject<{
    type: z.ZodDefault<z.ZodEnum<["none", "basic", "bearer", "api-key"]>>;
    username: z.ZodOptional<z.ZodString>;
    password: z.ZodOptional<z.ZodString>;
    token: z.ZodOptional<z.ZodString>;
    apiKey: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    password?: string;
    apiKey?: string;
    token?: string;
    type?: "none" | "basic" | "bearer" | "api-key";
    username?: string;
}, {
    password?: string;
    apiKey?: string;
    token?: string;
    type?: "none" | "basic" | "bearer" | "api-key";
    username?: string;
}>, {
    password?: string;
    apiKey?: string;
    token?: string;
    type?: "none" | "basic" | "bearer" | "api-key";
    username?: string;
}, {
    password?: string;
    apiKey?: string;
    token?: string;
    type?: "none" | "basic" | "bearer" | "api-key";
    username?: string;
}>;
export type SIEMAuthentication = z.infer<typeof SIEMAuthenticationSchema>;
export declare const SIEMConfigSchema: z.ZodObject<{
    /** Whether SIEM integration is enabled */
    enabled: z.ZodDefault<z.ZodBoolean>;
    /** SIEM provider type */
    provider: z.ZodDefault<z.ZodEnum<["loki", "splunk", "elastic"]>>;
    /** SIEM endpoint URL */
    endpoint: z.ZodString;
    /** Authentication configuration */
    authentication: z.ZodDefault<z.ZodEffects<z.ZodObject<{
        type: z.ZodDefault<z.ZodEnum<["none", "basic", "bearer", "api-key"]>>;
        username: z.ZodOptional<z.ZodString>;
        password: z.ZodOptional<z.ZodString>;
        token: z.ZodOptional<z.ZodString>;
        apiKey: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    }, {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    }>, {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    }, {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    }>>;
    /** Number of events to batch before sending (default: 100) */
    batchSize: z.ZodDefault<z.ZodNumber>;
    /** Flush interval in milliseconds (default: 5000) */
    flushIntervalMs: z.ZodDefault<z.ZodNumber>;
    /** Number of retry attempts on failure (default: 3) */
    retryAttempts: z.ZodDefault<z.ZodNumber>;
    /** Retry delay in milliseconds (default: 1000) */
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    /** Filter which event types to send (empty = all events) */
    eventTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    /** Application label for log categorization */
    appLabel: z.ZodDefault<z.ZodString>;
    /** Environment label (development, staging, production) */
    environmentLabel: z.ZodDefault<z.ZodString>;
    /** HTTP request timeout in milliseconds */
    timeoutMs: z.ZodDefault<z.ZodNumber>;
    /** Maximum queue size before dropping events */
    maxQueueSize: z.ZodDefault<z.ZodNumber>;
    /** Enable gzip compression for payloads */
    compression: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    timeoutMs?: number;
    enabled?: boolean;
    retryAttempts?: number;
    retryDelayMs?: number;
    provider?: "loki" | "splunk" | "elastic";
    authentication?: {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    };
    eventTypes?: string[];
    batchSize?: number;
    endpoint?: string;
    flushIntervalMs?: number;
    appLabel?: string;
    environmentLabel?: string;
    maxQueueSize?: number;
    compression?: boolean;
}, {
    timeoutMs?: number;
    enabled?: boolean;
    retryAttempts?: number;
    retryDelayMs?: number;
    provider?: "loki" | "splunk" | "elastic";
    authentication?: {
        password?: string;
        apiKey?: string;
        token?: string;
        type?: "none" | "basic" | "bearer" | "api-key";
        username?: string;
    };
    eventTypes?: string[];
    batchSize?: number;
    endpoint?: string;
    flushIntervalMs?: number;
    appLabel?: string;
    environmentLabel?: string;
    maxQueueSize?: number;
    compression?: boolean;
}>;
export type SIEMConfig = z.infer<typeof SIEMConfigSchema>;
export declare const SIEM_EVENT_CATEGORIES: readonly ["authentication", "authorization", "data-access", "configuration", "system", "security", "compliance", "network"];
export type SIEMEventCategory = (typeof SIEM_EVENT_CATEGORIES)[number];
export declare const SIEM_EVENT_SEVERITIES: readonly ["info", "warning", "error", "critical"];
export type SIEMEventSeverity = (typeof SIEM_EVENT_SEVERITIES)[number];
export declare const SIEM_EVENT_OUTCOMES: readonly ["success", "failure", "unknown"];
export type SIEMEventOutcome = (typeof SIEM_EVENT_OUTCOMES)[number];
export declare const SIEM_EVENT_TYPES: readonly ["USER_LOGIN", "USER_LOGOUT", "USER_LOGIN_FAILED", "SESSION_CREATED", "SESSION_EXPIRED", "SESSION_REVOKED", "TOKEN_ISSUED", "TOKEN_REVOKED", "MFA_CHALLENGE", "MFA_SUCCESS", "MFA_FAILURE", "MFA_BYPASS_ATTEMPTED", "PASSWORD_CHANGE", "PASSWORD_RESET_REQUESTED", "PASSWORD_RESET_COMPLETED", "PERMISSION_GRANTED", "PERMISSION_DENIED", "PERMISSION_REVOKED", "ROLE_CHANGED", "RESOURCE_CREATE", "RESOURCE_READ", "RESOURCE_UPDATE", "RESOURCE_DELETE", "RESOURCE_EXPORT", "CONFIG_CHANGE", "KEY_ROTATION", "SECRET_ACCESSED", "POLICY_UPDATE", "RATE_LIMIT_EXCEEDED", "INJECTION_ATTEMPT", "ANOMALY_DETECTED", "BRUTE_FORCE_DETECTED", "IP_BLOCKED", "SUSPICIOUS_ACTIVITY", "SYSTEM_STARTUP", "SYSTEM_SHUTDOWN", "HEALTH_CHECK_FAILED", "SERVICE_DEGRADED", "DATA_RETENTION_CLEANUP", "GDPR_REQUEST_RECEIVED", "AUDIT_LOG_EXPORTED", "TRUST_LEVEL_CHANGED", "ESCALATION_TRIGGERED", "INTENT_EVALUATED"];
export type SIEMAuditEventType = (typeof SIEM_EVENT_TYPES)[number];
export declare const AuditEventActorSchema: z.ZodObject<{
    /** User ID if authenticated */
    userId: z.ZodOptional<z.ZodString>;
    /** Tenant ID for multi-tenant systems */
    tenantId: z.ZodOptional<z.ZodString>;
    /** Client IP address */
    ipAddress: z.ZodString;
    /** User agent string */
    userAgent: z.ZodOptional<z.ZodString>;
    /** Session ID if applicable */
    sessionId: z.ZodOptional<z.ZodString>;
    /** Agent/service name if not a user */
    agentId: z.ZodOptional<z.ZodString>;
    /** Actor type: user, agent, service, system */
    actorType: z.ZodDefault<z.ZodEnum<["user", "agent", "service", "system"]>>;
}, "strip", z.ZodTypeAny, {
    userAgent?: string;
    tenantId?: string;
    userId?: string;
    sessionId?: string;
    actorType?: "agent" | "user" | "service" | "system";
    ipAddress?: string;
    agentId?: string;
}, {
    userAgent?: string;
    tenantId?: string;
    userId?: string;
    sessionId?: string;
    actorType?: "agent" | "user" | "service" | "system";
    ipAddress?: string;
    agentId?: string;
}>;
export type AuditEventActor = z.infer<typeof AuditEventActorSchema>;
export declare const AuditEventResourceSchema: z.ZodObject<{
    /** Resource type (e.g., 'user', 'intent', 'policy') */
    type: z.ZodString;
    /** Resource identifier */
    id: z.ZodString;
    /** Human-readable resource name */
    name: z.ZodOptional<z.ZodString>;
    /** Parent resource ID if hierarchical */
    parentId: z.ZodOptional<z.ZodString>;
    /** Additional resource attributes */
    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    parentId?: string;
    name?: string;
    id?: string;
    type?: string;
    attributes?: Record<string, unknown>;
}, {
    parentId?: string;
    name?: string;
    id?: string;
    type?: string;
    attributes?: Record<string, unknown>;
}>;
export type AuditEventResource = z.infer<typeof AuditEventResourceSchema>;
export declare const AuditEventMetadataSchema: z.ZodObject<{
    /** Unique request identifier */
    requestId: z.ZodString;
    /** Distributed trace ID (W3C TraceContext) */
    traceId: z.ZodOptional<z.ZodString>;
    /** Span ID for trace correlation */
    spanId: z.ZodOptional<z.ZodString>;
    /** Correlation ID for multi-step operations */
    correlationId: z.ZodOptional<z.ZodString>;
    /** Source service/component name */
    source: z.ZodOptional<z.ZodString>;
    /** Additional tags for filtering */
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    traceId?: string;
    spanId?: string;
    requestId?: string;
    source?: string;
    correlationId?: string;
    tags?: string[];
}, {
    traceId?: string;
    spanId?: string;
    requestId?: string;
    source?: string;
    correlationId?: string;
    tags?: string[];
}>;
export type AuditEventMetadata = z.infer<typeof AuditEventMetadataSchema>;
export declare const AuditEventSchema: z.ZodObject<{
    /** Unique event identifier */
    id: z.ZodString;
    /** Event timestamp */
    timestamp: z.ZodDate;
    /** Event type */
    type: z.ZodString;
    /** Event category */
    category: z.ZodEnum<["authentication", "authorization", "data-access", "configuration", "system", "security", "compliance", "network"]>;
    /** Event severity */
    severity: z.ZodEnum<["info", "warning", "error", "critical"]>;
    /** Actor information */
    actor: z.ZodObject<{
        /** User ID if authenticated */
        userId: z.ZodOptional<z.ZodString>;
        /** Tenant ID for multi-tenant systems */
        tenantId: z.ZodOptional<z.ZodString>;
        /** Client IP address */
        ipAddress: z.ZodString;
        /** User agent string */
        userAgent: z.ZodOptional<z.ZodString>;
        /** Session ID if applicable */
        sessionId: z.ZodOptional<z.ZodString>;
        /** Agent/service name if not a user */
        agentId: z.ZodOptional<z.ZodString>;
        /** Actor type: user, agent, service, system */
        actorType: z.ZodDefault<z.ZodEnum<["user", "agent", "service", "system"]>>;
    }, "strip", z.ZodTypeAny, {
        userAgent?: string;
        tenantId?: string;
        userId?: string;
        sessionId?: string;
        actorType?: "agent" | "user" | "service" | "system";
        ipAddress?: string;
        agentId?: string;
    }, {
        userAgent?: string;
        tenantId?: string;
        userId?: string;
        sessionId?: string;
        actorType?: "agent" | "user" | "service" | "system";
        ipAddress?: string;
        agentId?: string;
    }>;
    /** Resource information */
    resource: z.ZodObject<{
        /** Resource type (e.g., 'user', 'intent', 'policy') */
        type: z.ZodString;
        /** Resource identifier */
        id: z.ZodString;
        /** Human-readable resource name */
        name: z.ZodOptional<z.ZodString>;
        /** Parent resource ID if hierarchical */
        parentId: z.ZodOptional<z.ZodString>;
        /** Additional resource attributes */
        attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        parentId?: string;
        name?: string;
        id?: string;
        type?: string;
        attributes?: Record<string, unknown>;
    }, {
        parentId?: string;
        name?: string;
        id?: string;
        type?: string;
        attributes?: Record<string, unknown>;
    }>;
    /** Action performed */
    action: z.ZodString;
    /** Outcome of the action */
    outcome: z.ZodEnum<["success", "failure", "unknown"]>;
    /** Additional event details */
    details: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    /** Event metadata for correlation */
    metadata: z.ZodObject<{
        /** Unique request identifier */
        requestId: z.ZodString;
        /** Distributed trace ID (W3C TraceContext) */
        traceId: z.ZodOptional<z.ZodString>;
        /** Span ID for trace correlation */
        spanId: z.ZodOptional<z.ZodString>;
        /** Correlation ID for multi-step operations */
        correlationId: z.ZodOptional<z.ZodString>;
        /** Source service/component name */
        source: z.ZodOptional<z.ZodString>;
        /** Additional tags for filtering */
        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        traceId?: string;
        spanId?: string;
        requestId?: string;
        source?: string;
        correlationId?: string;
        tags?: string[];
    }, {
        traceId?: string;
        spanId?: string;
        requestId?: string;
        source?: string;
        correlationId?: string;
        tags?: string[];
    }>;
}, "strip", z.ZodTypeAny, {
    action?: string;
    details?: Record<string, unknown>;
    id?: string;
    type?: string;
    metadata?: {
        traceId?: string;
        spanId?: string;
        requestId?: string;
        source?: string;
        correlationId?: string;
        tags?: string[];
    };
    outcome?: "unknown" | "success" | "failure";
    severity?: "error" | "info" | "warning" | "critical";
    timestamp?: Date;
    resource?: {
        parentId?: string;
        name?: string;
        id?: string;
        type?: string;
        attributes?: Record<string, unknown>;
    };
    category?: "system" | "authorization" | "security" | "compliance" | "authentication" | "configuration" | "network" | "data-access";
    actor?: {
        userAgent?: string;
        tenantId?: string;
        userId?: string;
        sessionId?: string;
        actorType?: "agent" | "user" | "service" | "system";
        ipAddress?: string;
        agentId?: string;
    };
}, {
    action?: string;
    details?: Record<string, unknown>;
    id?: string;
    type?: string;
    metadata?: {
        traceId?: string;
        spanId?: string;
        requestId?: string;
        source?: string;
        correlationId?: string;
        tags?: string[];
    };
    outcome?: "unknown" | "success" | "failure";
    severity?: "error" | "info" | "warning" | "critical";
    timestamp?: Date;
    resource?: {
        parentId?: string;
        name?: string;
        id?: string;
        type?: string;
        attributes?: Record<string, unknown>;
    };
    category?: "system" | "authorization" | "security" | "compliance" | "authentication" | "configuration" | "network" | "data-access";
    actor?: {
        userAgent?: string;
        tenantId?: string;
        userId?: string;
        sessionId?: string;
        actorType?: "agent" | "user" | "service" | "system";
        ipAddress?: string;
        agentId?: string;
    };
}>;
export type AuditEvent = z.infer<typeof AuditEventSchema>;
/**
 * Interface for SIEM provider connectors
 */
export interface ISIEMConnector {
    /** Provider name */
    readonly provider: SIEMProvider;
    /** Check if the connector is healthy */
    healthCheck(): Promise<boolean>;
    /** Send a single event */
    sendEvent(event: AuditEvent): Promise<void>;
    /** Send a batch of events */
    sendBatch(events: AuditEvent[]): Promise<void>;
    /** Flush any buffered events */
    flush(): Promise<void>;
    /** Gracefully shutdown the connector */
    shutdown(): Promise<void>;
    /** Get connector statistics */
    getStats(): SIEMConnectorStats;
}
export interface SIEMConnectorStats {
    /** Total events sent successfully */
    eventsSent: number;
    /** Total events failed to send */
    eventsFailed: number;
    /** Total batches sent */
    batchesSent: number;
    /** Current queue size */
    queueSize: number;
    /** Last successful send timestamp */
    lastSuccessAt?: Date;
    /** Last error timestamp */
    lastErrorAt?: Date;
    /** Last error message */
    lastError?: string;
    /** Average batch latency in ms */
    avgLatencyMs: number;
    /** Events dropped due to queue overflow */
    eventsDropped: number;
    /** Total retry attempts */
    retryAttempts: number;
}
/**
 * Loki push API request format
 * See: https://grafana.com/docs/loki/latest/api/#push-log-entries-to-loki
 */
export interface LokiPushRequest {
    streams: LokiStream[];
}
export interface LokiStream {
    stream: Record<string, string>;
    values: LokiLogEntry[];
}
/** [timestamp_ns, log_line] */
export type LokiLogEntry = [string, string];
/**
 * Splunk HEC (HTTP Event Collector) event format
 * See: https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
 */
export interface SplunkHECEvent {
    /** Event timestamp (epoch seconds or milliseconds) */
    time?: number;
    /** Event host */
    host?: string;
    /** Event source */
    source?: string;
    /** Event sourcetype */
    sourcetype?: string;
    /** Index to store the event */
    index?: string;
    /** Event data */
    event: Record<string, unknown>;
    /** Additional fields */
    fields?: Record<string, unknown>;
}
/**
 * Elasticsearch bulk API action
 */
export interface ElasticBulkAction {
    index: {
        _index: string;
        _id?: string;
    };
}
/**
 * Elasticsearch document format for audit events
 */
export interface ElasticAuditDocument {
    '@timestamp': string;
    event: {
        id: string;
        type: string;
        category: string;
        severity: string;
        outcome: string;
        action: string;
    };
    user?: {
        id?: string;
        name?: string;
    };
    source: {
        ip: string;
        user_agent?: string;
    };
    resource: {
        type: string;
        id: string;
        name?: string;
    };
    metadata: Record<string, unknown>;
    details: Record<string, unknown>;
}
export declare class SIEMConnectionError extends Error {
    readonly provider: SIEMProvider;
    readonly endpoint: string;
    readonly statusCode?: number;
    readonly cause?: Error;
    constructor(message: string, provider: SIEMProvider, endpoint: string, statusCode?: number, cause?: Error);
}
export declare class SIEMConfigurationError extends Error {
    readonly provider: SIEMProvider;
    readonly field?: string;
    constructor(message: string, provider: SIEMProvider, field?: string);
}
export declare class SIEMBatchError extends Error {
    readonly provider: SIEMProvider;
    readonly failedCount: number;
    readonly totalCount: number;
    readonly cause?: Error;
    constructor(message: string, provider: SIEMProvider, failedCount: number, totalCount: number, cause?: Error);
}
//# sourceMappingURL=types.d.ts.map