// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * SIEM Connector Types
 *
 * Type definitions for the SIEM (Security Information and Event Management)
 * connector framework including:
 * - Security event structures
 * - Connector configurations
 * - Event formats (CEF, JSON, Syslog)
 * - Enrichment options
 *
 * @packageDocumentation
 * @module security/siem/types
 */
import { z } from 'zod';
// =============================================================================
// Event Severity & Types
// =============================================================================
/**
 * Event severity levels (aligned with CEF standard)
 */
export const EventSeverity = {
    UNKNOWN: 0,
    LOW: 1,
    MEDIUM: 4,
    HIGH: 7,
    CRITICAL: 10,
};
export const eventSeveritySchema = z.union([
    z.literal(0),
    z.literal(1),
    z.literal(4),
    z.literal(7),
    z.literal(10),
]);
/**
 * Event categories
 */
export const EventCategory = {
    AUTHENTICATION: 'authentication',
    AUTHORIZATION: 'authorization',
    NETWORK: 'network',
    APPLICATION: 'application',
    SYSTEM: 'system',
    MALWARE: 'malware',
    DATA: 'data',
    POLICY: 'policy',
    ANOMALY: 'anomaly',
    AUDIT: 'audit',
};
export const eventCategorySchema = z.nativeEnum(EventCategory);
/**
 * Event action outcome
 */
export const EventOutcome = {
    SUCCESS: 'success',
    FAILURE: 'failure',
    UNKNOWN: 'unknown',
};
export const eventOutcomeSchema = z.nativeEnum(EventOutcome);
export const geoLocationSchema = z.object({
    country: z.string().optional(),
    countryCode: z.string().optional(),
    city: z.string().optional(),
    region: z.string().optional(),
    latitude: z.number().optional(),
    longitude: z.number().optional(),
    timezone: z.string().optional(),
});
export const threatContextSchema = z.object({
    indicator: z.string().optional(),
    threatType: z.string().optional(),
    confidence: z.number().min(0).max(100).optional(),
    source: z.string().optional(),
    firstSeen: z.coerce.date().optional(),
    lastSeen: z.coerce.date().optional(),
    malwareFamilies: z.array(z.string()).optional(),
    threatActors: z.array(z.string()).optional(),
    mitreAttack: z.array(z.string()).optional(),
});
export const userContextSchema = z.object({
    userId: z.string().optional(),
    username: z.string().optional(),
    email: z.string().optional(),
    roles: z.array(z.string()).optional(),
    groups: z.array(z.string()).optional(),
    tenantId: z.string().optional(),
    tenantName: z.string().optional(),
    department: z.string().optional(),
    privileged: z.boolean().optional(),
});
export const securityEventSchema = z.object({
    id: z.string().min(1),
    timestamp: z.coerce.date(),
    eventType: z.string().min(1),
    category: eventCategorySchema,
    severity: eventSeveritySchema,
    outcome: eventOutcomeSchema,
    message: z.string().min(1),
    description: z.string().optional(),
    sourceIp: z.string().optional(),
    sourcePort: z.number().int().optional(),
    sourceHost: z.string().optional(),
    sourceMac: z.string().optional(),
    destinationIp: z.string().optional(),
    destinationPort: z.number().int().optional(),
    destinationHost: z.string().optional(),
    destinationMac: z.string().optional(),
    protocol: z.string().optional(),
    httpMethod: z.string().optional(),
    httpUrl: z.string().optional(),
    httpStatusCode: z.number().int().optional(),
    userAgent: z.string().optional(),
    requestId: z.string().optional(),
    processName: z.string().optional(),
    processId: z.number().int().optional(),
    filePath: z.string().optional(),
    fileHash: z.string().optional(),
    user: userContextSchema.optional(),
    geo: geoLocationSchema.optional(),
    threat: threatContextSchema.optional(),
    source: z.string().min(1),
    component: z.string().optional(),
    version: z.string().optional(),
    environment: z.string().optional(),
    tags: z.array(z.string()).optional(),
    customFields: z.record(z.unknown()).optional(),
    rawData: z.record(z.unknown()).optional(),
});
export const sendResultSchema = z.object({
    success: z.boolean(),
    eventsSent: z.number().int().nonnegative(),
    eventsFailed: z.number().int().nonnegative(),
    error: z.string().optional(),
    durationMs: z.number().nonnegative(),
    response: z.unknown().optional(),
    failedEventIds: z.array(z.string()).optional(),
});
export const baseConnectorConfigSchema = z.object({
    name: z.string().min(1),
    enabled: z.boolean().default(true),
    timeout: z.number().int().positive().default(30000),
    maxRetries: z.number().int().nonnegative().default(3),
    retryDelayMs: z.number().int().positive().default(1000),
    maxRetryDelayMs: z.number().int().positive().default(30000),
    batchSize: z.number().int().positive().default(100),
});
export const splunkConnectorConfigSchema = baseConnectorConfigSchema.extend({
    type: z.literal('splunk'),
    hecUrl: z.string().url(),
    token: z.string().min(1),
    index: z.string().optional(),
    sourcetype: z.string().optional(),
    source: z.string().optional(),
    host: z.string().optional(),
    verifySsl: z.boolean().default(true),
    defaultFields: z.record(z.string()).optional(),
});
export const elasticConnectorConfigSchema = baseConnectorConfigSchema.extend({
    type: z.literal('elastic'),
    nodes: z.array(z.string().url()).min(1),
    auth: z.enum(['apiKey', 'basic', 'bearer', 'none']),
    apiKey: z.string().optional(),
    username: z.string().optional(),
    password: z.string().optional(),
    bearerToken: z.string().optional(),
    cloudId: z.string().optional(),
    index: z.string().min(1),
    pipeline: z.string().optional(),
    verifySsl: z.boolean().default(true),
    refresh: z.enum(['true', 'false', 'wait_for']).optional(),
    caCert: z.string().optional(),
});
export const datadogConnectorConfigSchema = baseConnectorConfigSchema.extend({
    type: z.literal('datadog'),
    site: z.enum(['us1', 'us3', 'us5', 'eu1', 'ap1']),
    apiKey: z.string().min(1),
    service: z.string().min(1),
    source: z.string().optional(),
    hostname: z.string().optional(),
    tags: z.array(z.string()).optional(),
    compress: z.boolean().default(true),
});
export const connectorConfigSchema = z.discriminatedUnion('type', [
    splunkConnectorConfigSchema,
    elasticConnectorConfigSchema,
    datadogConnectorConfigSchema,
]);
// =============================================================================
// Event Format Configuration
// =============================================================================
/**
 * Event output format
 */
export const EventFormat = {
    JSON: 'json',
    CEF: 'cef',
    SYSLOG: 'syslog',
};
export const eventFormatSchema = z.nativeEnum(EventFormat);
export const cefConfigSchema = z.object({
    vendor: z.string().min(1),
    product: z.string().min(1),
    version: z.string().min(1),
    deviceEventClassIdPrefix: z.string().optional(),
});
export const syslogConfigSchema = z.object({
    facility: z.number().int().min(0).max(23),
    appName: z.string().min(1),
    procId: z.string().optional(),
    msgId: z.string().optional(),
    includeStructuredData: z.boolean().default(true),
});
export const geoEnrichmentConfigSchema = z.object({
    enabled: z.boolean().default(false),
    ipFields: z.array(z.string()).default(['sourceIp', 'destinationIp']),
    databasePath: z.string().optional(),
    serviceUrl: z.string().url().optional(),
    cacheTtlSeconds: z.number().int().positive().default(3600),
});
export const threatEnrichmentConfigSchema = z.object({
    enabled: z.boolean().default(false),
    serviceUrl: z.string().url().optional(),
    apiKey: z.string().optional(),
    indicatorFields: z.array(z.string()).default(['sourceIp', 'destinationIp', 'fileHash']),
    cacheTtlSeconds: z.number().int().positive().default(3600),
});
export const userEnrichmentConfigSchema = z.object({
    enabled: z.boolean().default(false),
    serviceUrl: z.string().url().optional(),
    includeRoles: z.boolean().default(true),
    includeGroups: z.boolean().default(true),
    includeTenant: z.boolean().default(true),
    cacheTtlSeconds: z.number().int().positive().default(300),
});
export const enrichmentConfigSchema = z.object({
    geo: geoEnrichmentConfigSchema.optional(),
    threat: threatEnrichmentConfigSchema.optional(),
    user: userEnrichmentConfigSchema.optional(),
    fieldNormalization: z.record(z.string()).optional(),
});
export const siemConfigSchema = z.object({
    connectors: z.array(connectorConfigSchema).default([]),
    batchSize: z.number().int().positive().default(100),
    flushIntervalMs: z.number().int().positive().default(5000),
    enabledEventTypes: z.array(z.string()).default([]),
    enrichment: enrichmentConfigSchema.default({}),
    defaultFormat: eventFormatSchema.optional(),
    cef: cefConfigSchema.optional(),
    syslog: syslogConfigSchema.optional(),
    circuitBreakerThreshold: z.number().int().positive().default(5),
    circuitBreakerResetMs: z.number().int().positive().default(60000),
    debugLogging: z.boolean().default(false),
    redisKeyPrefix: z.string().default('vorion:siem:'),
});
/**
 * Default SIEM configuration
 */
export const DEFAULT_SIEM_CONFIG = {
    batchSize: 100,
    flushIntervalMs: 5000,
    enabledEventTypes: [],
    enrichment: {},
    circuitBreakerThreshold: 5,
    circuitBreakerResetMs: 60000,
    debugLogging: false,
    redisKeyPrefix: 'vorion:siem:',
};
//# sourceMappingURL=types.js.map