/**
 * SIEM Service
 *
 * Main orchestration layer for SIEM integration:
 * - Register multiple connectors
 * - Fan-out events to all active connectors
 * - Buffering and batching (100 events or 5 seconds)
 * - Circuit breaker per connector
 * - Metrics: events sent, failures, latency
 *
 * @packageDocumentation
 * @module security/siem/service
 */
import type { SIEMConnector } from './connector.js';
import type { SecurityEvent, SendResult, SIEMConfig, SIEMMetrics, EventCategory, EventSeverity, EventOutcome, IntegrationHook } from './types.js';
/**
 * SIEM Service for managing SIEM connectors and event forwarding
 */
export declare class SIEMService {
    private readonly config;
    private readonly connectors;
    private readonly circuitBreakers;
    private readonly enricher;
    private readonly formatter;
    private readonly hooks;
    private buffer;
    private flushTimer;
    private flushing;
    private totalEventsSent;
    private totalEventsFailed;
    private totalBatchesSent;
    private totalBatchesFailed;
    private latencySum;
    private latencyCount;
    private lastSendTime?;
    private lastError?;
    constructor(config?: Partial<SIEMConfig>);
    /**
     * Send a security event to all active connectors
     */
    send(event: SecurityEvent): Promise<void>;
    /**
     * Send multiple events
     */
    sendBatch(events: SecurityEvent[]): Promise<void>;
    /**
     * Flush the event buffer to all connectors
     */
    flush(): Promise<Map<string, SendResult>>;
    /**
     * Register a connector
     */
    registerConnector(connector: SIEMConnector): void;
    /**
     * Unregister a connector
     */
    unregisterConnector(name: string): Promise<void>;
    /**
     * Get a connector by name
     */
    getConnector(name: string): SIEMConnector | undefined;
    /**
     * Get all connector names
     */
    getConnectorNames(): string[];
    /**
     * Connect all connectors
     */
    connectAll(): Promise<Map<string, boolean>>;
    /**
     * Disconnect all connectors
     */
    disconnectAll(): Promise<void>;
    /**
     * Health check all connectors
     */
    healthCheckAll(): Promise<Map<string, boolean>>;
    /**
     * Add an integration hook
     */
    addHook(hook: IntegrationHook): void;
    /**
     * Remove an integration hook
     */
    removeHook(name: string): void;
    /**
     * Get service metrics
     */
    getMetrics(): SIEMMetrics;
    /**
     * Shutdown the service
     */
    shutdown(): Promise<void>;
    /**
     * Create a security event with defaults
     */
    createEvent(params: {
        eventType: string;
        category: EventCategory;
        severity: EventSeverity;
        outcome: EventOutcome;
        message: string;
        sourceIp?: string;
        userId?: string;
        tenantId?: string;
        customFields?: Record<string, unknown>;
    }): SecurityEvent;
    /**
     * Initialize connectors from configuration
     */
    private initializeConnectors;
    /**
     * Create a connector from configuration
     */
    private createConnector;
    /**
     * Start the flush timer
     */
    private startFlushTimer;
    /**
     * Check if event type is enabled
     */
    private isEventTypeEnabled;
    /**
     * Initialize circuit breaker for a connector
     */
    private initializeCircuitBreaker;
    /**
     * Check if circuit breaker is open
     */
    private isCircuitOpen;
    /**
     * Record circuit breaker success
     */
    private recordCircuitBreakerSuccess;
    /**
     * Record circuit breaker failure
     */
    private recordCircuitBreakerFailure;
}
/**
 * Get or create the singleton SIEMService instance
 */
export declare function getSIEMService(config?: Partial<SIEMConfig>): SIEMService;
/**
 * Reset the singleton instance (primarily for testing)
 */
export declare function resetSIEMService(): Promise<void>;
/**
 * Create a new SIEMService instance (non-singleton)
 */
export declare function createSIEMService(config?: Partial<SIEMConfig>): SIEMService;
//# sourceMappingURL=service.d.ts.map