import type { Detector, DetectionResult, SecurityEvent } from '../types.js';
/**
 * Configuration for lateral movement detection
 */
export interface LateralMovementDetectorConfig {
    /** Maximum hops in a single session before alerting */
    maxHopsPerSession: number;
    /** Minimum time between hops to be considered suspicious (seconds) */
    minTimeBetweenHopsSeconds: number;
    /** High-sensitivity systems/services */
    highSensitivitySystems: string[];
    /** Service account patterns (regex) */
    serviceAccountPatterns: string[];
    /** Maximum cross-tenant access in session */
    maxCrossTenantsPerSession: number;
    /** System sensitivity levels */
    systemSensitivity: Record<string, number>;
    /** Enable service account monitoring */
    enableServiceAccountMonitoring: boolean;
}
export declare const DEFAULT_LATERAL_MOVEMENT_CONFIG: LateralMovementDetectorConfig;
/**
 * User's lateral movement baseline
 */
interface LateralMovementBaseline {
    userId: string;
    /** Normal systems accessed */
    normalSystems: string[];
    /** Normal services accessed */
    normalServices: string[];
    /** Normal tenants accessed */
    normalTenants: string[];
    /** Average systems per session */
    avgSystemsPerSession: number;
    /** Average hops per hour */
    avgHopsPerHour: number;
    /** Standard deviation of hops per hour */
    stdDevHopsPerHour: number;
    /** Total sessions tracked */
    sessionCount: number;
    /** Total events tracked */
    totalEvents: number;
    /** Last updated */
    lastUpdated: string;
}
/**
 * Lateral movement anomaly detector
 */
export declare class LateralMovementDetector implements Detector {
    readonly name = "lateral-movement";
    readonly description = "Detects access to new systems, unusual service account usage, and cross-tenant access patterns";
    private readonly config;
    private readonly redis;
    private readonly keyPrefix;
    constructor(config?: Partial<LateralMovementDetectorConfig>, keyPrefix?: string);
    /**
     * Analyze an event for lateral movement anomalies
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Learn from an event by updating baselines
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines
     */
    reset(): Promise<void>;
    /**
     * Get baseline for a specific user
     */
    getBaseline(userId: string): Promise<LateralMovementBaseline>;
    /**
     * Update baseline for a user based on a security event
     */
    updateBaseline(userId: string, event: SecurityEvent): Promise<void>;
    /**
     * Check if event is access-related
     */
    private isAccessEvent;
    /**
     * Check if user ID matches service account patterns
     */
    private isServiceAccount;
    /**
     * Check for access to new systems
     */
    private checkNewSystemAccess;
    /**
     * Check hop patterns for suspicious behavior
     */
    private checkHopPattern;
    /**
     * Check for service account anomalies
     */
    private checkServiceAccountAnomaly;
    /**
     * Check for cross-tenant access patterns
     */
    private checkCrossTenantAccess;
    /**
     * Check destination system sensitivity
     */
    private checkDestinationSensitivity;
    /**
     * Update hop tracking for current session
     */
    private updateHopTracking;
    /**
     * Update user's lateral movement baseline
     */
    private updateUserBaseline;
    /**
     * Update service account pattern
     */
    private updateServiceAccountPattern;
    /**
     * Update tenant access tracking
     */
    private updateTenantAccess;
    /**
     * Get service account pattern
     */
    private getServiceAccountPattern;
    /**
     * Get system sensitivity level
     */
    private getSystemSensitivity;
    /**
     * Create empty baseline for new user
     */
    private createEmptyBaseline;
    /**
     * Calculate combined risk score
     */
    private calculateRiskScore;
    /**
     * Generate human-readable description
     */
    private generateDescription;
    /**
     * Create a detection result
     */
    private createResult;
    /**
     * Delete keys matching a pattern
     */
    private deleteKeysByPattern;
}
/**
 * Create a new lateral movement detector instance
 */
export declare function createLateralMovementDetector(config?: Partial<LateralMovementDetectorConfig>, keyPrefix?: string): LateralMovementDetector;
export {};
//# sourceMappingURL=lateral-movement.d.ts.map