/**
 * Incident Triggers - Automatic Incident Creation from Alerts
 *
 * Maps alerts from various sources to incidents with appropriate severity,
 * type, and playbook selection.
 *
 * @packageDocumentation
 * @module security/incident/triggers
 */
import { EventEmitter } from 'events';
import { Alert, AlertRule, IncidentType, IncidentSeverity, CreateIncidentInput, Playbook } from './types.js';
import type { AnomalyAlert } from '../anomaly/types.js';
export interface IncidentTriggerConfig {
    /** Whether automatic triggering is enabled */
    enabled: boolean;
    /** Default cooldown between similar incidents (seconds) */
    defaultCooldownSeconds: number;
    /** Whether to deduplicate alerts */
    deduplication: {
        enabled: boolean;
        windowMinutes: number;
        hashFields: string[];
    };
    /** Whether to auto-merge related incidents */
    autoMerge: {
        enabled: boolean;
        windowMinutes: number;
    };
    /** Severity escalation rules */
    severityEscalation: {
        enabled: boolean;
        /** Number of similar alerts before escalation */
        alertCountThreshold: number;
        /** Time window for alert counting (minutes) */
        windowMinutes: number;
    };
}
export interface TriggerEvents {
    'alert:received': (alert: Alert) => void;
    'alert:matched': (alert: Alert, rule: AlertRule) => void;
    'alert:deduplicated': (alert: Alert, existingIncidentId: string) => void;
    'incident:created': (incidentInput: CreateIncidentInput, rule: AlertRule) => void;
    'incident:merged': (alertId: string, incidentId: string) => void;
}
export declare class IncidentTrigger extends EventEmitter {
    private readonly config;
    private readonly rules;
    private readonly playbooks;
    private readonly recentAlerts;
    private readonly alertCounts;
    private incidentCreator?;
    private cleanupInterval?;
    constructor(config?: Partial<IncidentTriggerConfig>);
    /**
     * Register the incident creator function
     */
    registerIncidentCreator(creator: (input: CreateIncidentInput) => Promise<{
        id: string;
    }>): void;
    /**
     * Register playbooks for auto-selection
     */
    registerPlaybooks(playbooks: Playbook[]): void;
    /**
     * Add or update an alert rule
     */
    addRule(rule: AlertRule): void;
    /**
     * Remove an alert rule
     */
    removeRule(ruleId: string): boolean;
    /**
     * Get all rules
     */
    getRules(): AlertRule[];
    /**
     * Process an alert and potentially create an incident
     */
    processAlert(alert: Alert): Promise<{
        incidentCreated: boolean;
        incidentId?: string;
        reason?: string;
    }>;
    /**
     * Process an anomaly alert from the anomaly detection system
     */
    processAnomalyAlert(anomalyAlert: AnomalyAlert): Promise<{
        incidentCreated: boolean;
        incidentId?: string;
        reason?: string;
    }>;
    /**
     * Map from alert severity to incident severity
     */
    mapAlertSeverityToIncident(alertSeverity: Alert['severity']): IncidentSeverity;
    /**
     * Map from anomaly severity to alert severity
     */
    private mapAnomalySeverity;
    /**
     * Select appropriate playbook for incident type
     */
    selectPlaybook(incidentType: IncidentType, severity: IncidentSeverity): Playbook | undefined;
    /**
     * Clean up resources
     */
    destroy(): void;
    private findMatchingRule;
    private evaluateConditions;
    private evaluateCondition;
    private getFieldValue;
    private checkDeduplication;
    private calculateAlertHash;
    private checkSeverityEscalation;
    private buildIncidentInput;
    private applyTemplate;
    private startCleanupInterval;
}
export declare function createIncidentTrigger(config?: Partial<IncidentTriggerConfig>): IncidentTrigger;
//# sourceMappingURL=triggers.d.ts.map