/**
 * Anomaly Detection Types
 *
 * Type definitions for the rule-based anomaly detection engine.
 * Provides interfaces for detecting suspicious patterns including:
 * - Impossible travel (geographic anomalies)
 * - Unusual access times (temporal anomalies)
 * - Volume spikes (behavioral anomalies)
 * - New device access
 * - Authentication failure spikes
 * - Privilege probing attempts
 *
 * @packageDocumentation
 * @module security/anomaly/types
 */
import { z } from 'zod';
/**
 * Types of anomalies that can be detected
 */
export declare const AnomalyType: {
    readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
    readonly UNUSUAL_TIME: "unusual-time";
    readonly VOLUME_SPIKE: "volume-spike";
    readonly NEW_DEVICE: "new-device";
    readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
    readonly PRIVILEGE_PROBE: "privilege-probe";
};
export type AnomalyType = (typeof AnomalyType)[keyof typeof AnomalyType];
export declare const anomalyTypeSchema: z.ZodNativeEnum<{
    readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
    readonly UNUSUAL_TIME: "unusual-time";
    readonly VOLUME_SPIKE: "volume-spike";
    readonly NEW_DEVICE: "new-device";
    readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
    readonly PRIVILEGE_PROBE: "privilege-probe";
}>;
/**
 * Severity levels for detected anomalies
 */
export declare const AnomalySeverity: {
    readonly LOW: "low";
    readonly MEDIUM: "medium";
    readonly HIGH: "high";
    readonly CRITICAL: "critical";
};
export type AnomalySeverity = (typeof AnomalySeverity)[keyof typeof AnomalySeverity];
export declare const anomalySeveritySchema: z.ZodNativeEnum<{
    readonly LOW: "low";
    readonly MEDIUM: "medium";
    readonly HIGH: "high";
    readonly CRITICAL: "critical";
}>;
/**
 * An indicator of compromise or suspicious activity
 */
export interface Indicator {
    /** Type of indicator */
    type: string;
    /** Human-readable description */
    description: string;
    /** Raw value of the indicator */
    value: string | number | boolean;
    /** Weight/importance of this indicator (0-100) */
    weight: number;
}
export declare const indicatorSchema: z.ZodObject<{
    type: z.ZodString;
    description: z.ZodString;
    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
    weight: z.ZodNumber;
}, "strip", z.ZodTypeAny, {
    value?: string | number | boolean;
    description?: string;
    type?: string;
    weight?: number;
}, {
    value?: string | number | boolean;
    description?: string;
    type?: string;
    weight?: number;
}>;
/**
 * A detected anomaly
 */
export interface Anomaly {
    /** Unique anomaly ID */
    id: string;
    /** When the anomaly was detected */
    timestamp: Date;
    /** Type of anomaly */
    type: AnomalyType;
    /** Severity level */
    severity: AnomalySeverity;
    /** Confidence score (0-100) */
    confidence: number;
    /** User ID if associated with a user */
    userId?: string;
    /** Tenant ID if multi-tenant */
    tenantId?: string;
    /** IP address if relevant */
    ipAddress?: string;
    /** Human-readable description */
    description: string;
    /** List of indicators that contributed to detection */
    indicators: Indicator[];
    /** Suggested actions to take */
    suggestedActions: string[];
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
export declare const anomalySchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    type: z.ZodNativeEnum<{
        readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
        readonly UNUSUAL_TIME: "unusual-time";
        readonly VOLUME_SPIKE: "volume-spike";
        readonly NEW_DEVICE: "new-device";
        readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
        readonly PRIVILEGE_PROBE: "privilege-probe";
    }>;
    severity: z.ZodNativeEnum<{
        readonly LOW: "low";
        readonly MEDIUM: "medium";
        readonly HIGH: "high";
        readonly CRITICAL: "critical";
    }>;
    confidence: z.ZodNumber;
    userId: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
    ipAddress: z.ZodOptional<z.ZodString>;
    description: z.ZodString;
    indicators: z.ZodArray<z.ZodObject<{
        type: z.ZodString;
        description: z.ZodString;
        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
        weight: z.ZodNumber;
    }, "strip", z.ZodTypeAny, {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }, {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }>, "many">;
    suggestedActions: z.ZodArray<z.ZodString, "many">;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    description?: string;
    type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
    metadata?: Record<string, unknown>;
    tenantId?: string;
    userId?: string;
    severity?: "critical" | "low" | "medium" | "high";
    ipAddress?: string;
    timestamp?: Date;
    confidence?: number;
    suggestedActions?: string[];
    indicators?: {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }[];
}, {
    id?: string;
    description?: string;
    type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
    metadata?: Record<string, unknown>;
    tenantId?: string;
    userId?: string;
    severity?: "critical" | "low" | "medium" | "high";
    ipAddress?: string;
    timestamp?: Date;
    confidence?: number;
    suggestedActions?: string[];
    indicators?: {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }[];
}>;
/**
 * Configuration for the anomaly detector
 */
export interface AnomalyDetectorConfig {
    /** Whether anomaly detection is enabled */
    enabled: boolean;
    /** List of enabled detector names */
    detectors: string[];
    /** Minimum confidence threshold for alerting (0-100) */
    alertThreshold: number;
    /** Number of days to learn normal behavior patterns */
    learningPeriodDays: number;
    /** Whether to automatically block suspicious IPs/users */
    autoBlock: boolean;
    /** Confidence threshold for automatic blocking (0-100) */
    autoBlockThreshold: number;
    /** Redis key prefix for storage */
    redisKeyPrefix?: string;
}
export declare const anomalyDetectorConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    detectors: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    alertThreshold: z.ZodDefault<z.ZodNumber>;
    learningPeriodDays: z.ZodDefault<z.ZodNumber>;
    autoBlock: z.ZodDefault<z.ZodBoolean>;
    autoBlockThreshold: z.ZodDefault<z.ZodNumber>;
    redisKeyPrefix: z.ZodDefault<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    enabled?: boolean;
    redisKeyPrefix?: string;
    detectors?: string[];
    alertThreshold?: number;
    learningPeriodDays?: number;
    autoBlock?: boolean;
    autoBlockThreshold?: number;
}, {
    enabled?: boolean;
    redisKeyPrefix?: string;
    detectors?: string[];
    alertThreshold?: number;
    learningPeriodDays?: number;
    autoBlock?: boolean;
    autoBlockThreshold?: number;
}>;
/**
 * Default configuration values
 */
export declare const DEFAULT_ANOMALY_DETECTOR_CONFIG: AnomalyDetectorConfig;
/**
 * Geographic location data
 */
export interface GeoLocation {
    /** Latitude in decimal degrees */
    latitude: number;
    /** Longitude in decimal degrees */
    longitude: number;
    /** Country code (ISO 3166-1 alpha-2) */
    countryCode?: string;
    /** City name */
    city?: string;
    /** Region/state */
    region?: string;
    /** Timezone */
    timezone?: string;
}
export declare const geoLocationSchema: z.ZodObject<{
    latitude: z.ZodNumber;
    longitude: z.ZodNumber;
    countryCode: z.ZodOptional<z.ZodString>;
    city: z.ZodOptional<z.ZodString>;
    region: z.ZodOptional<z.ZodString>;
    timezone: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    region?: string;
    city?: string;
    latitude?: number;
    longitude?: number;
    timezone?: string;
    countryCode?: string;
}, {
    region?: string;
    city?: string;
    latitude?: number;
    longitude?: number;
    timezone?: string;
    countryCode?: string;
}>;
/**
 * Configuration for geographic anomaly detection
 */
export interface GeographicDetectorConfig {
    /** Maximum travel speed in km/h before flagging as impossible */
    maxTravelSpeedKmh: number;
    /** Minimum distance in km to consider for travel analysis */
    minDistanceKm: number;
    /** List of country codes to flag as high risk */
    highRiskCountries: string[];
    /** Whether to flag VPN/proxy usage */
    flagVpnUsage: boolean;
}
export declare const geographicDetectorConfigSchema: z.ZodObject<{
    maxTravelSpeedKmh: z.ZodDefault<z.ZodNumber>;
    minDistanceKm: z.ZodDefault<z.ZodNumber>;
    highRiskCountries: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    flagVpnUsage: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    maxTravelSpeedKmh?: number;
    minDistanceKm?: number;
    highRiskCountries?: string[];
    flagVpnUsage?: boolean;
}, {
    maxTravelSpeedKmh?: number;
    minDistanceKm?: number;
    highRiskCountries?: string[];
    flagVpnUsage?: boolean;
}>;
export declare const DEFAULT_GEOGRAPHIC_DETECTOR_CONFIG: GeographicDetectorConfig;
/**
 * Configuration for temporal anomaly detection
 */
export interface TemporalDetectorConfig {
    /** Hours of the day considered normal for access (0-23) */
    normalHoursStart: number;
    /** End of normal hours (0-23) */
    normalHoursEnd: number;
    /** Days of the week considered normal (0=Sunday, 6=Saturday) */
    normalDays: number[];
    /** Whether to learn user-specific patterns */
    learnUserPatterns: boolean;
    /** Minimum number of events to establish a baseline */
    minEventsForBaseline: number;
}
export declare const temporalDetectorConfigSchema: z.ZodObject<{
    normalHoursStart: z.ZodDefault<z.ZodNumber>;
    normalHoursEnd: z.ZodDefault<z.ZodNumber>;
    normalDays: z.ZodDefault<z.ZodArray<z.ZodNumber, "many">>;
    learnUserPatterns: z.ZodDefault<z.ZodBoolean>;
    minEventsForBaseline: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    normalHoursStart?: number;
    normalHoursEnd?: number;
    normalDays?: number[];
    learnUserPatterns?: boolean;
    minEventsForBaseline?: number;
}, {
    normalHoursStart?: number;
    normalHoursEnd?: number;
    normalDays?: number[];
    learnUserPatterns?: boolean;
    minEventsForBaseline?: number;
}>;
export declare const DEFAULT_TEMPORAL_DETECTOR_CONFIG: TemporalDetectorConfig;
/**
 * User access pattern for temporal analysis
 */
export interface UserAccessPattern {
    /** User ID */
    userId: string;
    /** Histogram of access hours (24 bins) */
    hourHistogram: number[];
    /** Histogram of access days (7 bins) */
    dayHistogram: number[];
    /** Total number of events tracked */
    totalEvents: number;
    /** When the pattern was last updated */
    lastUpdated: Date;
}
export declare const userAccessPatternSchema: z.ZodObject<{
    userId: z.ZodString;
    hourHistogram: z.ZodArray<z.ZodNumber, "many">;
    dayHistogram: z.ZodArray<z.ZodNumber, "many">;
    totalEvents: z.ZodNumber;
    lastUpdated: z.ZodDate;
}, "strip", z.ZodTypeAny, {
    userId?: string;
    hourHistogram?: number[];
    dayHistogram?: number[];
    totalEvents?: number;
    lastUpdated?: Date;
}, {
    userId?: string;
    hourHistogram?: number[];
    dayHistogram?: number[];
    totalEvents?: number;
    lastUpdated?: Date;
}>;
/**
 * Configuration for volume spike detection
 */
export interface VolumeDetectorConfig {
    /** Time window in minutes for rate calculation */
    windowMinutes: number;
    /** Standard deviations above mean to trigger alert */
    spikeThresholdStdDev: number;
    /** Absolute maximum requests per window before alert */
    absoluteMaxRequests: number;
    /** Whether to track per-user volumes */
    trackPerUser: boolean;
    /** Whether to track per-IP volumes */
    trackPerIp: boolean;
    /** Whether to track per-endpoint volumes */
    trackPerEndpoint: boolean;
}
export declare const volumeDetectorConfigSchema: z.ZodObject<{
    windowMinutes: z.ZodDefault<z.ZodNumber>;
    spikeThresholdStdDev: z.ZodDefault<z.ZodNumber>;
    absoluteMaxRequests: z.ZodDefault<z.ZodNumber>;
    trackPerUser: z.ZodDefault<z.ZodBoolean>;
    trackPerIp: z.ZodDefault<z.ZodBoolean>;
    trackPerEndpoint: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    windowMinutes?: number;
    spikeThresholdStdDev?: number;
    absoluteMaxRequests?: number;
    trackPerUser?: boolean;
    trackPerIp?: boolean;
    trackPerEndpoint?: boolean;
}, {
    windowMinutes?: number;
    spikeThresholdStdDev?: number;
    absoluteMaxRequests?: number;
    trackPerUser?: boolean;
    trackPerIp?: boolean;
    trackPerEndpoint?: boolean;
}>;
export declare const DEFAULT_VOLUME_DETECTOR_CONFIG: VolumeDetectorConfig;
/**
 * Volume baseline statistics
 */
export interface VolumeBaseline {
    /** Identifier (user ID, IP, or endpoint) */
    identifier: string;
    /** Type of identifier */
    identifierType: 'user' | 'ip' | 'endpoint';
    /** Mean requests per window */
    mean: number;
    /** Standard deviation */
    stdDev: number;
    /** Number of samples in baseline */
    sampleCount: number;
    /** When the baseline was last updated */
    lastUpdated: Date;
}
export declare const volumeBaselineSchema: z.ZodObject<{
    identifier: z.ZodString;
    identifierType: z.ZodEnum<["user", "ip", "endpoint"]>;
    mean: z.ZodNumber;
    stdDev: z.ZodNumber;
    sampleCount: z.ZodNumber;
    lastUpdated: z.ZodDate;
}, "strip", z.ZodTypeAny, {
    identifier?: string;
    lastUpdated?: Date;
    identifierType?: "user" | "ip" | "endpoint";
    mean?: number;
    stdDev?: number;
    sampleCount?: number;
}, {
    identifier?: string;
    lastUpdated?: Date;
    identifierType?: "user" | "ip" | "endpoint";
    mean?: number;
    stdDev?: number;
    sampleCount?: number;
}>;
/**
 * A security event to be analyzed for anomalies
 */
export interface SecurityEvent {
    /** Unique event ID */
    eventId: string;
    /** Event timestamp */
    timestamp: Date;
    /** Event type (e.g., 'login', 'api_call', 'permission_check') */
    eventType: string;
    /** User ID if authenticated */
    userId?: string;
    /** Tenant ID if multi-tenant */
    tenantId?: string;
    /** IP address of the request */
    ipAddress: string;
    /** User agent string */
    userAgent?: string;
    /** Geographic location if available */
    location?: GeoLocation;
    /** Requested resource/endpoint */
    resource?: string;
    /** HTTP method if applicable */
    method?: string;
    /** Whether the request was successful */
    success: boolean;
    /** Failure reason if unsuccessful */
    failureReason?: string;
    /** Device fingerprint if available */
    deviceFingerprint?: string;
    /** Additional event metadata */
    metadata?: Record<string, unknown>;
}
export declare const securityEventSchema: z.ZodObject<{
    eventId: z.ZodString;
    timestamp: z.ZodDate;
    eventType: z.ZodString;
    userId: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
    ipAddress: z.ZodString;
    userAgent: z.ZodOptional<z.ZodString>;
    location: z.ZodOptional<z.ZodObject<{
        latitude: z.ZodNumber;
        longitude: z.ZodNumber;
        countryCode: z.ZodOptional<z.ZodString>;
        city: z.ZodOptional<z.ZodString>;
        region: z.ZodOptional<z.ZodString>;
        timezone: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        region?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        timezone?: string;
        countryCode?: string;
    }, {
        region?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        timezone?: string;
        countryCode?: string;
    }>>;
    resource: z.ZodOptional<z.ZodString>;
    method: z.ZodOptional<z.ZodString>;
    success: z.ZodBoolean;
    failureReason: z.ZodOptional<z.ZodString>;
    deviceFingerprint: z.ZodOptional<z.ZodString>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    metadata?: Record<string, unknown>;
    userAgent?: string;
    tenantId?: string;
    location?: {
        region?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        timezone?: string;
        countryCode?: string;
    };
    success?: boolean;
    userId?: string;
    method?: string;
    failureReason?: string;
    eventType?: string;
    ipAddress?: string;
    timestamp?: Date;
    resource?: string;
    eventId?: string;
    deviceFingerprint?: string;
}, {
    metadata?: Record<string, unknown>;
    userAgent?: string;
    tenantId?: string;
    location?: {
        region?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        timezone?: string;
        countryCode?: string;
    };
    success?: boolean;
    userId?: string;
    method?: string;
    failureReason?: string;
    eventType?: string;
    ipAddress?: string;
    timestamp?: Date;
    resource?: string;
    eventId?: string;
    deviceFingerprint?: string;
}>;
/**
 * Result from a single detector
 */
export interface DetectionResult {
    /** Name of the detector */
    detectorName: string;
    /** Whether an anomaly was detected */
    anomalyDetected: boolean;
    /** Confidence score if anomaly detected (0-100) */
    confidence?: number;
    /** Severity if anomaly detected */
    severity?: AnomalySeverity;
    /** Description of the finding */
    description?: string;
    /** Indicators found */
    indicators: Indicator[];
    /** Suggested actions */
    suggestedActions: string[];
    /** Time taken for detection in milliseconds */
    durationMs: number;
    /** Error if detection failed */
    error?: string;
}
export declare const detectionResultSchema: z.ZodObject<{
    detectorName: z.ZodString;
    anomalyDetected: z.ZodBoolean;
    confidence: z.ZodOptional<z.ZodNumber>;
    severity: z.ZodOptional<z.ZodNativeEnum<{
        readonly LOW: "low";
        readonly MEDIUM: "medium";
        readonly HIGH: "high";
        readonly CRITICAL: "critical";
    }>>;
    description: z.ZodOptional<z.ZodString>;
    indicators: z.ZodArray<z.ZodObject<{
        type: z.ZodString;
        description: z.ZodString;
        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
        weight: z.ZodNumber;
    }, "strip", z.ZodTypeAny, {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }, {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }>, "many">;
    suggestedActions: z.ZodArray<z.ZodString, "many">;
    durationMs: z.ZodNumber;
    error: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    error?: string;
    durationMs?: number;
    description?: string;
    severity?: "critical" | "low" | "medium" | "high";
    confidence?: number;
    suggestedActions?: string[];
    indicators?: {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }[];
    detectorName?: string;
    anomalyDetected?: boolean;
}, {
    error?: string;
    durationMs?: number;
    description?: string;
    severity?: "critical" | "low" | "medium" | "high";
    confidence?: number;
    suggestedActions?: string[];
    indicators?: {
        value?: string | number | boolean;
        description?: string;
        type?: string;
        weight?: number;
    }[];
    detectorName?: string;
    anomalyDetected?: boolean;
}>;
/**
 * Aggregated result from all detectors
 */
export interface AggregatedDetectionResult {
    /** The event that was analyzed */
    event: SecurityEvent;
    /** Results from individual detectors */
    detectorResults: DetectionResult[];
    /** Combined anomalies (if any) */
    anomalies: Anomaly[];
    /** Total processing time in milliseconds */
    totalDurationMs: number;
    /** Timestamp of analysis */
    analyzedAt: Date;
}
export declare const aggregatedDetectionResultSchema: z.ZodObject<{
    event: z.ZodObject<{
        eventId: z.ZodString;
        timestamp: z.ZodDate;
        eventType: z.ZodString;
        userId: z.ZodOptional<z.ZodString>;
        tenantId: z.ZodOptional<z.ZodString>;
        ipAddress: z.ZodString;
        userAgent: z.ZodOptional<z.ZodString>;
        location: z.ZodOptional<z.ZodObject<{
            latitude: z.ZodNumber;
            longitude: z.ZodNumber;
            countryCode: z.ZodOptional<z.ZodString>;
            city: z.ZodOptional<z.ZodString>;
            region: z.ZodOptional<z.ZodString>;
            timezone: z.ZodOptional<z.ZodString>;
        }, "strip", z.ZodTypeAny, {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        }, {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        }>>;
        resource: z.ZodOptional<z.ZodString>;
        method: z.ZodOptional<z.ZodString>;
        success: z.ZodBoolean;
        failureReason: z.ZodOptional<z.ZodString>;
        deviceFingerprint: z.ZodOptional<z.ZodString>;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        metadata?: Record<string, unknown>;
        userAgent?: string;
        tenantId?: string;
        location?: {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        };
        success?: boolean;
        userId?: string;
        method?: string;
        failureReason?: string;
        eventType?: string;
        ipAddress?: string;
        timestamp?: Date;
        resource?: string;
        eventId?: string;
        deviceFingerprint?: string;
    }, {
        metadata?: Record<string, unknown>;
        userAgent?: string;
        tenantId?: string;
        location?: {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        };
        success?: boolean;
        userId?: string;
        method?: string;
        failureReason?: string;
        eventType?: string;
        ipAddress?: string;
        timestamp?: Date;
        resource?: string;
        eventId?: string;
        deviceFingerprint?: string;
    }>;
    detectorResults: z.ZodArray<z.ZodObject<{
        detectorName: z.ZodString;
        anomalyDetected: z.ZodBoolean;
        confidence: z.ZodOptional<z.ZodNumber>;
        severity: z.ZodOptional<z.ZodNativeEnum<{
            readonly LOW: "low";
            readonly MEDIUM: "medium";
            readonly HIGH: "high";
            readonly CRITICAL: "critical";
        }>>;
        description: z.ZodOptional<z.ZodString>;
        indicators: z.ZodArray<z.ZodObject<{
            type: z.ZodString;
            description: z.ZodString;
            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
            weight: z.ZodNumber;
        }, "strip", z.ZodTypeAny, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }>, "many">;
        suggestedActions: z.ZodArray<z.ZodString, "many">;
        durationMs: z.ZodNumber;
        error: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        error?: string;
        durationMs?: number;
        description?: string;
        severity?: "critical" | "low" | "medium" | "high";
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
        detectorName?: string;
        anomalyDetected?: boolean;
    }, {
        error?: string;
        durationMs?: number;
        description?: string;
        severity?: "critical" | "low" | "medium" | "high";
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
        detectorName?: string;
        anomalyDetected?: boolean;
    }>, "many">;
    anomalies: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        timestamp: z.ZodDate;
        type: z.ZodNativeEnum<{
            readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
            readonly UNUSUAL_TIME: "unusual-time";
            readonly VOLUME_SPIKE: "volume-spike";
            readonly NEW_DEVICE: "new-device";
            readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
            readonly PRIVILEGE_PROBE: "privilege-probe";
        }>;
        severity: z.ZodNativeEnum<{
            readonly LOW: "low";
            readonly MEDIUM: "medium";
            readonly HIGH: "high";
            readonly CRITICAL: "critical";
        }>;
        confidence: z.ZodNumber;
        userId: z.ZodOptional<z.ZodString>;
        tenantId: z.ZodOptional<z.ZodString>;
        ipAddress: z.ZodOptional<z.ZodString>;
        description: z.ZodString;
        indicators: z.ZodArray<z.ZodObject<{
            type: z.ZodString;
            description: z.ZodString;
            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
            weight: z.ZodNumber;
        }, "strip", z.ZodTypeAny, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }>, "many">;
        suggestedActions: z.ZodArray<z.ZodString, "many">;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }, {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }>, "many">;
    totalDurationMs: z.ZodNumber;
    analyzedAt: z.ZodDate;
}, "strip", z.ZodTypeAny, {
    totalDurationMs?: number;
    event?: {
        metadata?: Record<string, unknown>;
        userAgent?: string;
        tenantId?: string;
        location?: {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        };
        success?: boolean;
        userId?: string;
        method?: string;
        failureReason?: string;
        eventType?: string;
        ipAddress?: string;
        timestamp?: Date;
        resource?: string;
        eventId?: string;
        deviceFingerprint?: string;
    };
    detectorResults?: {
        error?: string;
        durationMs?: number;
        description?: string;
        severity?: "critical" | "low" | "medium" | "high";
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
        detectorName?: string;
        anomalyDetected?: boolean;
    }[];
    anomalies?: {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }[];
    analyzedAt?: Date;
}, {
    totalDurationMs?: number;
    event?: {
        metadata?: Record<string, unknown>;
        userAgent?: string;
        tenantId?: string;
        location?: {
            region?: string;
            city?: string;
            latitude?: number;
            longitude?: number;
            timezone?: string;
            countryCode?: string;
        };
        success?: boolean;
        userId?: string;
        method?: string;
        failureReason?: string;
        eventType?: string;
        ipAddress?: string;
        timestamp?: Date;
        resource?: string;
        eventId?: string;
        deviceFingerprint?: string;
    };
    detectorResults?: {
        error?: string;
        durationMs?: number;
        description?: string;
        severity?: "critical" | "low" | "medium" | "high";
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
        detectorName?: string;
        anomalyDetected?: boolean;
    }[];
    anomalies?: {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }[];
    analyzedAt?: Date;
}>;
/**
 * Interface that all detectors must implement
 */
export interface Detector {
    /** Unique name of the detector */
    readonly name: string;
    /** Human-readable description */
    readonly description: string;
    /**
     * Analyze an event for anomalies
     * @param event The security event to analyze
     * @returns Detection result
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Update baselines with new event data
     * @param event The event to learn from
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines
     */
    reset(): Promise<void>;
}
/**
 * An alert generated from detected anomalies
 */
export interface AnomalyAlert {
    /** Unique alert ID */
    alertId: string;
    /** The anomaly that triggered the alert */
    anomaly: Anomaly;
    /** Alert status */
    status: 'open' | 'acknowledged' | 'resolved' | 'dismissed';
    /** When the alert was created */
    createdAt: Date;
    /** When the alert was last updated */
    updatedAt: Date;
    /** User who acknowledged/resolved the alert */
    handledBy?: string;
    /** Notes added during handling */
    notes?: string;
    /** Whether automatic action was taken */
    autoActionTaken: boolean;
    /** Description of automatic action if taken */
    autoActionDescription?: string;
}
export declare const anomalyAlertSchema: z.ZodObject<{
    alertId: z.ZodString;
    anomaly: z.ZodObject<{
        id: z.ZodString;
        timestamp: z.ZodDate;
        type: z.ZodNativeEnum<{
            readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
            readonly UNUSUAL_TIME: "unusual-time";
            readonly VOLUME_SPIKE: "volume-spike";
            readonly NEW_DEVICE: "new-device";
            readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
            readonly PRIVILEGE_PROBE: "privilege-probe";
        }>;
        severity: z.ZodNativeEnum<{
            readonly LOW: "low";
            readonly MEDIUM: "medium";
            readonly HIGH: "high";
            readonly CRITICAL: "critical";
        }>;
        confidence: z.ZodNumber;
        userId: z.ZodOptional<z.ZodString>;
        tenantId: z.ZodOptional<z.ZodString>;
        ipAddress: z.ZodOptional<z.ZodString>;
        description: z.ZodString;
        indicators: z.ZodArray<z.ZodObject<{
            type: z.ZodString;
            description: z.ZodString;
            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
            weight: z.ZodNumber;
        }, "strip", z.ZodTypeAny, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }, {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }>, "many">;
        suggestedActions: z.ZodArray<z.ZodString, "many">;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }, {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    }>;
    status: z.ZodEnum<["open", "acknowledged", "resolved", "dismissed"]>;
    createdAt: z.ZodDate;
    updatedAt: z.ZodDate;
    handledBy: z.ZodOptional<z.ZodString>;
    notes: z.ZodOptional<z.ZodString>;
    autoActionTaken: z.ZodBoolean;
    autoActionDescription: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    status?: "acknowledged" | "open" | "resolved" | "dismissed";
    createdAt?: Date;
    updatedAt?: Date;
    notes?: string;
    alertId?: string;
    anomaly?: {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    };
    handledBy?: string;
    autoActionTaken?: boolean;
    autoActionDescription?: string;
}, {
    status?: "acknowledged" | "open" | "resolved" | "dismissed";
    createdAt?: Date;
    updatedAt?: Date;
    notes?: string;
    alertId?: string;
    anomaly?: {
        id?: string;
        description?: string;
        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
        metadata?: Record<string, unknown>;
        tenantId?: string;
        userId?: string;
        severity?: "critical" | "low" | "medium" | "high";
        ipAddress?: string;
        timestamp?: Date;
        confidence?: number;
        suggestedActions?: string[];
        indicators?: {
            value?: string | number | boolean;
            description?: string;
            type?: string;
            weight?: number;
        }[];
    };
    handledBy?: string;
    autoActionTaken?: boolean;
    autoActionDescription?: string;
}>;
/**
 * Callback function for when an anomaly is detected
 */
export type AnomalyCallback = (anomaly: Anomaly) => void | Promise<void>;
/**
 * Callback function for when an alert should be generated
 */
export type AlertCallback = (alert: AnomalyAlert) => void | Promise<void>;
//# sourceMappingURL=types.d.ts.map