import { BaseSIEMConnector } from './connector.js';
import type { SecurityEvent, SendResult, DatadogConnectorConfig } from './types.js';
/**
 * Datadog connector for SIEM integration
 *
 * Features:
 * - Logs API v2 for efficient ingestion
 * - Tag-based event categorization
 * - Gzip compression for large payloads
 * - Multi-site support
 */
export declare class DatadogConnector extends BaseSIEMConnector {
    readonly type = "datadog";
    private readonly site;
    private readonly apiKey;
    private readonly service;
    private readonly source;
    private readonly hostname?;
    private readonly defaultTags;
    private readonly compress;
    private readonly baseUrl;
    constructor(config: DatadogConnectorConfig);
    /**
     * Connect to Datadog (verify API key)
     */
    protected doConnect(): Promise<void>;
    /**
     * Disconnect from Datadog (no-op for HTTP)
     */
    protected doDisconnect(): Promise<void>;
    /**
     * Send events to Datadog Logs API
     */
    protected doSend(events: SecurityEvent[]): Promise<SendResult>;
    /**
     * Send a single batch to Datadog
     */
    private sendBatch;
    /**
     * Health check - validate API key
     */
    protected doHealthCheck(): Promise<boolean>;
    /**
     * Convert security event to Datadog log format
     */
    private toDatadogLog;
    /**
     * Build network attributes
     */
    private buildNetworkAttributes;
    /**
     * Build user attributes
     */
    private buildUserAttributes;
    /**
     * Get severity name from numeric value
     */
    private getSeverityName;
    /**
     * Remove undefined values from object
     */
    private removeUndefined;
}
/**
 * Create a Datadog connector
 */
export declare function createDatadogConnector(config: DatadogConnectorConfig): DatadogConnector;
//# sourceMappingURL=datadog.d.ts.map