import type { SecurityEvent, EnrichmentConfig, GeoLocation, ThreatContext, UserContext, GeoEnrichmentConfig, ThreatEnrichmentConfig, UserEnrichmentConfig } from './types.js';
/**
 * Enrichment result
 */
export interface EnrichmentResult {
    /** Enriched event */
    event: SecurityEvent;
    /** Fields that were enriched */
    enrichedFields: string[];
    /** Errors during enrichment */
    errors: Array<{
        field: string;
        error: string;
    }>;
    /** Time taken in milliseconds */
    durationMs: number;
}
/**
 * Provider interface for geo enrichment
 */
export interface GeoEnrichmentProvider {
    /** Lookup geo data for an IP address */
    lookup(ip: string): Promise<GeoLocation | null>;
}
/**
 * Default geo enrichment provider using external service
 */
export declare class DefaultGeoProvider implements GeoEnrichmentProvider {
    private readonly serviceUrl?;
    private readonly cache;
    private readonly cacheTtlMs;
    constructor(config: GeoEnrichmentConfig);
    lookup(ip: string): Promise<GeoLocation | null>;
    private isPrivateIp;
}
/**
 * Provider interface for threat intelligence enrichment
 */
export interface ThreatEnrichmentProvider {
    /** Lookup threat data for an indicator */
    lookup(indicator: string, type: string): Promise<ThreatContext | null>;
}
/**
 * Default threat intelligence provider
 */
export declare class DefaultThreatProvider implements ThreatEnrichmentProvider {
    private readonly serviceUrl?;
    private readonly apiKey?;
    private readonly cache;
    private readonly cacheTtlMs;
    constructor(config: ThreatEnrichmentConfig);
    lookup(indicator: string, type: string): Promise<ThreatContext | null>;
}
/**
 * Provider interface for user context enrichment
 */
export interface UserEnrichmentProvider {
    /** Lookup user data by user ID */
    lookup(userId: string): Promise<UserContext | null>;
}
/**
 * Default user enrichment provider
 */
export declare class DefaultUserProvider implements UserEnrichmentProvider {
    private readonly serviceUrl?;
    private readonly includeRoles;
    private readonly includeGroups;
    private readonly includeTenant;
    private readonly cache;
    private readonly cacheTtlMs;
    constructor(config: UserEnrichmentConfig);
    lookup(userId: string): Promise<UserContext | null>;
}
/**
 * Event enricher that combines multiple enrichment sources
 */
export declare class EventEnricher {
    private readonly config;
    private readonly geoProvider?;
    private readonly threatProvider?;
    private readonly userProvider?;
    private readonly fieldNormalization;
    constructor(config: EnrichmentConfig, options?: {
        geoProvider?: GeoEnrichmentProvider;
        threatProvider?: ThreatEnrichmentProvider;
        userProvider?: UserEnrichmentProvider;
    });
    /**
     * Enrich a security event
     */
    enrich(event: SecurityEvent): Promise<EnrichmentResult>;
    /**
     * Enrich multiple events
     */
    enrichBatch(events: SecurityEvent[]): Promise<EnrichmentResult[]>;
    /**
     * Get a field value from an event
     */
    private getFieldValue;
    /**
     * Get indicator type based on field name
     */
    private getIndicatorType;
    /**
     * Normalize field names
     */
    private normalizeFields;
}
/**
 * Create an event enricher
 */
export declare function createEventEnricher(config: EnrichmentConfig, options?: {
    geoProvider?: GeoEnrichmentProvider;
    threatProvider?: ThreatEnrichmentProvider;
    userProvider?: UserEnrichmentProvider;
}): EventEnricher;
/**
 * Create a no-op enricher (passthrough)
 */
export declare function createNoOpEnricher(): EventEnricher;
//# sourceMappingURL=enrichment.d.ts.map