import type { SecurityEvent, EventFormat, CEFConfig, SyslogConfig } from './types.js';
/**
 * Event formatter for multiple output formats
 */
export declare class EventFormatter {
    private readonly cefConfig?;
    private readonly syslogConfig?;
    constructor(options?: {
        cef?: CEFConfig;
        syslog?: SyslogConfig;
    });
    /**
     * Format an event in the specified format
     */
    format(event: SecurityEvent, format: EventFormat): string;
    /**
     * Format as JSON
     */
    formatJSON(event: SecurityEvent): string;
    /**
     * Format as CEF (Common Event Format)
     *
     * CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|[Extension]
     */
    formatCEF(event: SecurityEvent): string;
    /**
     * Format as Syslog (RFC 5424)
     *
     * <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID ...] MSG
     */
    formatSyslog(event: SecurityEvent): string;
    /**
     * Build CEF extension field
     */
    private buildCEFExtension;
    /**
     * Build syslog structured data
     */
    private buildSyslogStructuredData;
    /**
     * Build a single structured data element
     */
    private buildStructuredDataElement;
    /**
     * Escape CEF header value
     */
    private escapeCEFHeader;
    /**
     * Escape CEF extension value
     */
    private escapeCEFExtension;
    /**
     * Escape syslog param value (RFC 5424)
     */
    private escapeSyslogParamValue;
}
/**
 * Normalize field names across different schemas
 */
export declare class FieldNormalizer {
    private readonly mappings;
    constructor(mappings?: Record<string, string>);
    /**
     * Normalize a security event's field names
     */
    normalize(event: SecurityEvent): SecurityEvent;
    /**
     * Normalize field names in an object
     */
    private normalizeObject;
    /**
     * Add a field mapping
     */
    addMapping(from: string, to: string): void;
    /**
     * Remove a field mapping
     */
    removeMapping(from: string): void;
    /**
     * Get all mappings
     */
    getMappings(): Record<string, string>;
}
/**
 * Create an event formatter
 */
export declare function createEventFormatter(options?: {
    cef?: CEFConfig;
    syslog?: SyslogConfig;
}): EventFormatter;
/**
 * Create a field normalizer
 */
export declare function createFieldNormalizer(mappings?: Record<string, string>): FieldNormalizer;
/**
 * Get the default event formatter
 */
export declare function getDefaultFormatter(): EventFormatter;
/**
 * Set the default event formatter configuration
 */
export declare function configureDefaultFormatter(options: {
    cef?: CEFConfig;
    syslog?: SyslogConfig;
}): void;
//# sourceMappingURL=formatter.d.ts.map