/**
 * SIEM Connector Types
 *
 * Type definitions for the SIEM (Security Information and Event Management)
 * connector framework including:
 * - Security event structures
 * - Connector configurations
 * - Event formats (CEF, JSON, Syslog)
 * - Enrichment options
 *
 * @packageDocumentation
 * @module security/siem/types
 */
import { z } from 'zod';
/**
 * Event severity levels (aligned with CEF standard)
 */
export declare const EventSeverity: {
    readonly UNKNOWN: 0;
    readonly LOW: 1;
    readonly MEDIUM: 4;
    readonly HIGH: 7;
    readonly CRITICAL: 10;
};
export type EventSeverity = (typeof EventSeverity)[keyof typeof EventSeverity];
export declare const eventSeveritySchema: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<4>, z.ZodLiteral<7>, z.ZodLiteral<10>]>;
/**
 * Event categories
 */
export declare const EventCategory: {
    readonly AUTHENTICATION: "authentication";
    readonly AUTHORIZATION: "authorization";
    readonly NETWORK: "network";
    readonly APPLICATION: "application";
    readonly SYSTEM: "system";
    readonly MALWARE: "malware";
    readonly DATA: "data";
    readonly POLICY: "policy";
    readonly ANOMALY: "anomaly";
    readonly AUDIT: "audit";
};
export type EventCategory = (typeof EventCategory)[keyof typeof EventCategory];
export declare const eventCategorySchema: z.ZodNativeEnum<{
    readonly AUTHENTICATION: "authentication";
    readonly AUTHORIZATION: "authorization";
    readonly NETWORK: "network";
    readonly APPLICATION: "application";
    readonly SYSTEM: "system";
    readonly MALWARE: "malware";
    readonly DATA: "data";
    readonly POLICY: "policy";
    readonly ANOMALY: "anomaly";
    readonly AUDIT: "audit";
}>;
/**
 * Event action outcome
 */
export declare const EventOutcome: {
    readonly SUCCESS: "success";
    readonly FAILURE: "failure";
    readonly UNKNOWN: "unknown";
};
export type EventOutcome = (typeof EventOutcome)[keyof typeof EventOutcome];
export declare const eventOutcomeSchema: z.ZodNativeEnum<{
    readonly SUCCESS: "success";
    readonly FAILURE: "failure";
    readonly UNKNOWN: "unknown";
}>;
/**
 * Geographic location data for events
 */
export interface GeoLocation {
    /** Country name */
    country?: string;
    /** Country ISO code */
    countryCode?: string;
    /** City name */
    city?: string;
    /** Region/state */
    region?: string;
    /** Latitude */
    latitude?: number;
    /** Longitude */
    longitude?: number;
    /** Timezone */
    timezone?: string;
}
export declare const geoLocationSchema: z.ZodObject<{
    country: z.ZodOptional<z.ZodString>;
    countryCode: z.ZodOptional<z.ZodString>;
    city: z.ZodOptional<z.ZodString>;
    region: z.ZodOptional<z.ZodString>;
    latitude: z.ZodOptional<z.ZodNumber>;
    longitude: z.ZodOptional<z.ZodNumber>;
    timezone: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    country?: string;
    city?: string;
    latitude?: number;
    longitude?: number;
    region?: string;
    countryCode?: string;
    timezone?: string;
}, {
    country?: string;
    city?: string;
    latitude?: number;
    longitude?: number;
    region?: string;
    countryCode?: string;
    timezone?: string;
}>;
/**
 * Threat intelligence context
 */
export interface ThreatContext {
    /** Known threat indicator */
    indicator?: string;
    /** Threat type (e.g., malware, botnet, spam) */
    threatType?: string;
    /** Confidence score (0-100) */
    confidence?: number;
    /** Threat feed source */
    source?: string;
    /** First seen timestamp */
    firstSeen?: Date;
    /** Last seen timestamp */
    lastSeen?: Date;
    /** Associated malware families */
    malwareFamilies?: string[];
    /** Associated threat actors */
    threatActors?: string[];
    /** MITRE ATT&CK techniques */
    mitreAttack?: string[];
}
export declare const threatContextSchema: z.ZodObject<{
    indicator: z.ZodOptional<z.ZodString>;
    threatType: z.ZodOptional<z.ZodString>;
    confidence: z.ZodOptional<z.ZodNumber>;
    source: z.ZodOptional<z.ZodString>;
    firstSeen: z.ZodOptional<z.ZodDate>;
    lastSeen: z.ZodOptional<z.ZodDate>;
    malwareFamilies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    threatActors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    mitreAttack: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    source?: string;
    indicator?: string;
    threatType?: string;
    confidence?: number;
    firstSeen?: Date;
    lastSeen?: Date;
    malwareFamilies?: string[];
    threatActors?: string[];
    mitreAttack?: string[];
}, {
    source?: string;
    indicator?: string;
    threatType?: string;
    confidence?: number;
    firstSeen?: Date;
    lastSeen?: Date;
    malwareFamilies?: string[];
    threatActors?: string[];
    mitreAttack?: string[];
}>;
/**
 * User context for events
 */
export interface UserContext {
    /** User ID */
    userId?: string;
    /** Username */
    username?: string;
    /** User email */
    email?: string;
    /** User roles */
    roles?: string[];
    /** User groups */
    groups?: string[];
    /** Tenant/organization ID */
    tenantId?: string;
    /** Tenant/organization name */
    tenantName?: string;
    /** Department */
    department?: string;
    /** Whether user is privileged */
    privileged?: boolean;
}
export declare const userContextSchema: z.ZodObject<{
    userId: z.ZodOptional<z.ZodString>;
    username: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    tenantId: z.ZodOptional<z.ZodString>;
    tenantName: z.ZodOptional<z.ZodString>;
    department: z.ZodOptional<z.ZodString>;
    privileged: z.ZodOptional<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    userId?: string;
    email?: string;
    groups?: string[];
    tenantId?: string;
    roles?: string[];
    username?: string;
    tenantName?: string;
    department?: string;
    privileged?: boolean;
}, {
    userId?: string;
    email?: string;
    groups?: string[];
    tenantId?: string;
    roles?: string[];
    username?: string;
    tenantName?: string;
    department?: string;
    privileged?: boolean;
}>;
/**
 * A security event to be sent to SIEM
 */
export interface SecurityEvent {
    /** Unique event ID */
    id: string;
    /** Event timestamp */
    timestamp: Date;
    /** Event type/name */
    eventType: string;
    /** Event category */
    category: EventCategory;
    /** Event severity (0-10) */
    severity: EventSeverity;
    /** Action outcome */
    outcome: EventOutcome;
    /** Human-readable message */
    message: string;
    /** Detailed description */
    description?: string;
    /** Source IP address */
    sourceIp?: string;
    /** Source port */
    sourcePort?: number;
    /** Source hostname */
    sourceHost?: string;
    /** Source MAC address */
    sourceMac?: string;
    /** Destination IP address */
    destinationIp?: string;
    /** Destination port */
    destinationPort?: number;
    /** Destination hostname */
    destinationHost?: string;
    /** Destination MAC address */
    destinationMac?: string;
    /** Network protocol */
    protocol?: string;
    /** HTTP method */
    httpMethod?: string;
    /** HTTP URL */
    httpUrl?: string;
    /** HTTP status code */
    httpStatusCode?: number;
    /** User agent */
    userAgent?: string;
    /** Request ID */
    requestId?: string;
    /** Process name */
    processName?: string;
    /** Process ID */
    processId?: number;
    /** File path */
    filePath?: string;
    /** File hash */
    fileHash?: string;
    /** User context */
    user?: UserContext;
    /** Geographic location */
    geo?: GeoLocation;
    /** Threat intelligence context */
    threat?: ThreatContext;
    /** Source application/service name */
    source: string;
    /** Source component */
    component?: string;
    /** Source version */
    version?: string;
    /** Environment (production, staging, etc.) */
    environment?: string;
    /** Event tags */
    tags?: string[];
    /** Custom fields */
    customFields?: Record<string, unknown>;
    /** Raw event data for detailed analysis */
    rawData?: Record<string, unknown>;
}
export declare const securityEventSchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    eventType: z.ZodString;
    category: z.ZodNativeEnum<{
        readonly AUTHENTICATION: "authentication";
        readonly AUTHORIZATION: "authorization";
        readonly NETWORK: "network";
        readonly APPLICATION: "application";
        readonly SYSTEM: "system";
        readonly MALWARE: "malware";
        readonly DATA: "data";
        readonly POLICY: "policy";
        readonly ANOMALY: "anomaly";
        readonly AUDIT: "audit";
    }>;
    severity: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<4>, z.ZodLiteral<7>, z.ZodLiteral<10>]>;
    outcome: z.ZodNativeEnum<{
        readonly SUCCESS: "success";
        readonly FAILURE: "failure";
        readonly UNKNOWN: "unknown";
    }>;
    message: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    sourceIp: z.ZodOptional<z.ZodString>;
    sourcePort: z.ZodOptional<z.ZodNumber>;
    sourceHost: z.ZodOptional<z.ZodString>;
    sourceMac: z.ZodOptional<z.ZodString>;
    destinationIp: z.ZodOptional<z.ZodString>;
    destinationPort: z.ZodOptional<z.ZodNumber>;
    destinationHost: z.ZodOptional<z.ZodString>;
    destinationMac: z.ZodOptional<z.ZodString>;
    protocol: z.ZodOptional<z.ZodString>;
    httpMethod: z.ZodOptional<z.ZodString>;
    httpUrl: z.ZodOptional<z.ZodString>;
    httpStatusCode: z.ZodOptional<z.ZodNumber>;
    userAgent: z.ZodOptional<z.ZodString>;
    requestId: z.ZodOptional<z.ZodString>;
    processName: z.ZodOptional<z.ZodString>;
    processId: z.ZodOptional<z.ZodNumber>;
    filePath: z.ZodOptional<z.ZodString>;
    fileHash: z.ZodOptional<z.ZodString>;
    user: z.ZodOptional<z.ZodObject<{
        userId: z.ZodOptional<z.ZodString>;
        username: z.ZodOptional<z.ZodString>;
        email: z.ZodOptional<z.ZodString>;
        roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        tenantId: z.ZodOptional<z.ZodString>;
        tenantName: z.ZodOptional<z.ZodString>;
        department: z.ZodOptional<z.ZodString>;
        privileged: z.ZodOptional<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        userId?: string;
        email?: string;
        groups?: string[];
        tenantId?: string;
        roles?: string[];
        username?: string;
        tenantName?: string;
        department?: string;
        privileged?: boolean;
    }, {
        userId?: string;
        email?: string;
        groups?: string[];
        tenantId?: string;
        roles?: string[];
        username?: string;
        tenantName?: string;
        department?: string;
        privileged?: boolean;
    }>>;
    geo: z.ZodOptional<z.ZodObject<{
        country: z.ZodOptional<z.ZodString>;
        countryCode: z.ZodOptional<z.ZodString>;
        city: z.ZodOptional<z.ZodString>;
        region: z.ZodOptional<z.ZodString>;
        latitude: z.ZodOptional<z.ZodNumber>;
        longitude: z.ZodOptional<z.ZodNumber>;
        timezone: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        country?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        region?: string;
        countryCode?: string;
        timezone?: string;
    }, {
        country?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        region?: string;
        countryCode?: string;
        timezone?: string;
    }>>;
    threat: z.ZodOptional<z.ZodObject<{
        indicator: z.ZodOptional<z.ZodString>;
        threatType: z.ZodOptional<z.ZodString>;
        confidence: z.ZodOptional<z.ZodNumber>;
        source: z.ZodOptional<z.ZodString>;
        firstSeen: z.ZodOptional<z.ZodDate>;
        lastSeen: z.ZodOptional<z.ZodDate>;
        malwareFamilies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        threatActors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        mitreAttack: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        source?: string;
        indicator?: string;
        threatType?: string;
        confidence?: number;
        firstSeen?: Date;
        lastSeen?: Date;
        malwareFamilies?: string[];
        threatActors?: string[];
        mitreAttack?: string[];
    }, {
        source?: string;
        indicator?: string;
        threatType?: string;
        confidence?: number;
        firstSeen?: Date;
        lastSeen?: Date;
        malwareFamilies?: string[];
        threatActors?: string[];
        mitreAttack?: string[];
    }>>;
    source: z.ZodString;
    component: z.ZodOptional<z.ZodString>;
    version: z.ZodOptional<z.ZodString>;
    environment: z.ZodOptional<z.ZodString>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    customFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    rawData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    message?: string;
    version?: string;
    component?: string;
    timestamp?: Date;
    user?: {
        userId?: string;
        email?: string;
        groups?: string[];
        tenantId?: string;
        roles?: string[];
        username?: string;
        tenantName?: string;
        department?: string;
        privileged?: boolean;
    };
    tags?: string[];
    description?: string;
    requestId?: string;
    environment?: string;
    userAgent?: string;
    outcome?: "unknown" | "success" | "failure";
    source?: string;
    eventType?: string;
    severity?: 0 | 7 | 1 | 4 | 10;
    category?: "authentication" | "authorization" | "system" | "audit" | "data" | "policy" | "network" | "application" | "malware" | "anomaly";
    protocol?: string;
    sourceIp?: string;
    sourcePort?: number;
    sourceHost?: string;
    sourceMac?: string;
    destinationIp?: string;
    destinationPort?: number;
    destinationHost?: string;
    destinationMac?: string;
    httpMethod?: string;
    httpUrl?: string;
    httpStatusCode?: number;
    processName?: string;
    processId?: number;
    filePath?: string;
    fileHash?: string;
    geo?: {
        country?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        region?: string;
        countryCode?: string;
        timezone?: string;
    };
    threat?: {
        source?: string;
        indicator?: string;
        threatType?: string;
        confidence?: number;
        firstSeen?: Date;
        lastSeen?: Date;
        malwareFamilies?: string[];
        threatActors?: string[];
        mitreAttack?: string[];
    };
    customFields?: Record<string, unknown>;
    rawData?: Record<string, unknown>;
}, {
    id?: string;
    message?: string;
    version?: string;
    component?: string;
    timestamp?: Date;
    user?: {
        userId?: string;
        email?: string;
        groups?: string[];
        tenantId?: string;
        roles?: string[];
        username?: string;
        tenantName?: string;
        department?: string;
        privileged?: boolean;
    };
    tags?: string[];
    description?: string;
    requestId?: string;
    environment?: string;
    userAgent?: string;
    outcome?: "unknown" | "success" | "failure";
    source?: string;
    eventType?: string;
    severity?: 0 | 7 | 1 | 4 | 10;
    category?: "authentication" | "authorization" | "system" | "audit" | "data" | "policy" | "network" | "application" | "malware" | "anomaly";
    protocol?: string;
    sourceIp?: string;
    sourcePort?: number;
    sourceHost?: string;
    sourceMac?: string;
    destinationIp?: string;
    destinationPort?: number;
    destinationHost?: string;
    destinationMac?: string;
    httpMethod?: string;
    httpUrl?: string;
    httpStatusCode?: number;
    processName?: string;
    processId?: number;
    filePath?: string;
    fileHash?: string;
    geo?: {
        country?: string;
        city?: string;
        latitude?: number;
        longitude?: number;
        region?: string;
        countryCode?: string;
        timezone?: string;
    };
    threat?: {
        source?: string;
        indicator?: string;
        threatType?: string;
        confidence?: number;
        firstSeen?: Date;
        lastSeen?: Date;
        malwareFamilies?: string[];
        threatActors?: string[];
        mitreAttack?: string[];
    };
    customFields?: Record<string, unknown>;
    rawData?: Record<string, unknown>;
}>;
/**
 * Result of sending events to a SIEM connector
 */
export interface SendResult {
    /** Whether the send was successful */
    success: boolean;
    /** Number of events sent */
    eventsSent: number;
    /** Number of events that failed */
    eventsFailed: number;
    /** Error message if failed */
    error?: string;
    /** Time taken in milliseconds */
    durationMs: number;
    /** Response from the SIEM system */
    response?: unknown;
    /** IDs of failed events */
    failedEventIds?: string[];
}
export declare const sendResultSchema: z.ZodObject<{
    success: z.ZodBoolean;
    eventsSent: z.ZodNumber;
    eventsFailed: z.ZodNumber;
    error: z.ZodOptional<z.ZodString>;
    durationMs: z.ZodNumber;
    response: z.ZodOptional<z.ZodUnknown>;
    failedEventIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    response?: unknown;
    error?: string;
    success?: boolean;
    durationMs?: number;
    eventsSent?: number;
    eventsFailed?: number;
    failedEventIds?: string[];
}, {
    response?: unknown;
    error?: string;
    success?: boolean;
    durationMs?: number;
    eventsSent?: number;
    eventsFailed?: number;
    failedEventIds?: string[];
}>;
/**
 * Base connector configuration
 */
export interface BaseConnectorConfig {
    /** Connector name */
    name: string;
    /** Whether connector is enabled */
    enabled: boolean;
    /** Request timeout in ms */
    timeout?: number;
    /** Maximum retry attempts */
    maxRetries?: number;
    /** Base delay for exponential backoff in ms */
    retryDelayMs?: number;
    /** Maximum backoff delay in ms */
    maxRetryDelayMs?: number;
    /** Batch size for bulk operations */
    batchSize?: number;
}
export declare const baseConnectorConfigSchema: z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    timeout?: number;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    batchSize?: number;
}, {
    name?: string;
    timeout?: number;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    batchSize?: number;
}>;
/**
 * Splunk HEC connector configuration
 */
export interface SplunkConnectorConfig extends BaseConnectorConfig {
    type: 'splunk';
    /** Splunk HEC URL */
    hecUrl: string;
    /** HEC token */
    token: string;
    /** Default index */
    index?: string;
    /** Default sourcetype */
    sourcetype?: string;
    /** Default source */
    source?: string;
    /** Default host */
    host?: string;
    /** Whether to verify SSL */
    verifySsl?: boolean;
    /** Custom fields to add to all events */
    defaultFields?: Record<string, string>;
}
export declare const splunkConnectorConfigSchema: z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"splunk">;
    hecUrl: z.ZodString;
    token: z.ZodString;
    index: z.ZodOptional<z.ZodString>;
    sourcetype: z.ZodOptional<z.ZodString>;
    source: z.ZodOptional<z.ZodString>;
    host: z.ZodOptional<z.ZodString>;
    verifySsl: z.ZodDefault<z.ZodBoolean>;
    defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
}, "strip", z.ZodTypeAny, {
    type?: "splunk";
    name?: string;
    timeout?: number;
    token?: string;
    host?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    source?: string;
    index?: string;
    batchSize?: number;
    hecUrl?: string;
    sourcetype?: string;
    verifySsl?: boolean;
    defaultFields?: Record<string, string>;
}, {
    type?: "splunk";
    name?: string;
    timeout?: number;
    token?: string;
    host?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    source?: string;
    index?: string;
    batchSize?: number;
    hecUrl?: string;
    sourcetype?: string;
    verifySsl?: boolean;
    defaultFields?: Record<string, string>;
}>;
/**
 * Elasticsearch connector configuration
 */
export interface ElasticConnectorConfig extends BaseConnectorConfig {
    type: 'elastic';
    /** Elasticsearch node URLs */
    nodes: string[];
    /** Authentication type */
    auth: 'apiKey' | 'basic' | 'bearer' | 'none';
    /** API key (for apiKey auth) */
    apiKey?: string;
    /** Username (for basic auth) */
    username?: string;
    /** Password (for basic auth) */
    password?: string;
    /** Bearer token (for bearer auth) */
    bearerToken?: string;
    /** Cloud ID (for Elastic Cloud) */
    cloudId?: string;
    /** Index name or pattern */
    index: string;
    /** Pipeline name */
    pipeline?: string;
    /** Whether to verify SSL */
    verifySsl?: boolean;
    /** Refresh policy */
    refresh?: 'true' | 'false' | 'wait_for';
    /** Custom CA certificate */
    caCert?: string;
}
export declare const elasticConnectorConfigSchema: z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"elastic">;
    nodes: z.ZodArray<z.ZodString, "many">;
    auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
    apiKey: z.ZodOptional<z.ZodString>;
    username: z.ZodOptional<z.ZodString>;
    password: z.ZodOptional<z.ZodString>;
    bearerToken: z.ZodOptional<z.ZodString>;
    cloudId: z.ZodOptional<z.ZodString>;
    index: z.ZodString;
    pipeline: z.ZodOptional<z.ZodString>;
    verifySsl: z.ZodDefault<z.ZodBoolean>;
    refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
    caCert: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    type?: "elastic";
    name?: string;
    timeout?: number;
    password?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    pipeline?: string;
    refresh?: "true" | "false" | "wait_for";
    enabled?: boolean;
    username?: string;
    auth?: "none" | "apiKey" | "basic" | "bearer";
    index?: string;
    caCert?: string;
    batchSize?: number;
    verifySsl?: boolean;
    nodes?: string[];
    bearerToken?: string;
    cloudId?: string;
}, {
    type?: "elastic";
    name?: string;
    timeout?: number;
    password?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    pipeline?: string;
    refresh?: "true" | "false" | "wait_for";
    enabled?: boolean;
    username?: string;
    auth?: "none" | "apiKey" | "basic" | "bearer";
    index?: string;
    caCert?: string;
    batchSize?: number;
    verifySsl?: boolean;
    nodes?: string[];
    bearerToken?: string;
    cloudId?: string;
}>;
/**
 * Datadog connector configuration
 */
export interface DatadogConnectorConfig extends BaseConnectorConfig {
    type: 'datadog';
    /** Datadog site (us1, us3, us5, eu1, ap1) */
    site: 'us1' | 'us3' | 'us5' | 'eu1' | 'ap1';
    /** API key */
    apiKey: string;
    /** Service name */
    service: string;
    /** Source */
    source?: string;
    /** Hostname */
    hostname?: string;
    /** Default tags */
    tags?: string[];
    /** Whether to compress payloads */
    compress?: boolean;
}
export declare const datadogConnectorConfigSchema: z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"datadog">;
    site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
    apiKey: z.ZodString;
    service: z.ZodString;
    source: z.ZodOptional<z.ZodString>;
    hostname: z.ZodOptional<z.ZodString>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    compress: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    type?: "datadog";
    name?: string;
    timeout?: number;
    service?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    tags?: string[];
    enabled?: boolean;
    source?: string;
    hostname?: string;
    batchSize?: number;
    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
    compress?: boolean;
}, {
    type?: "datadog";
    name?: string;
    timeout?: number;
    service?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    tags?: string[];
    enabled?: boolean;
    source?: string;
    hostname?: string;
    batchSize?: number;
    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
    compress?: boolean;
}>;
/**
 * Union type for all connector configurations
 */
export type ConnectorConfig = SplunkConnectorConfig | ElasticConnectorConfig | DatadogConnectorConfig;
export declare const connectorConfigSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"splunk">;
    hecUrl: z.ZodString;
    token: z.ZodString;
    index: z.ZodOptional<z.ZodString>;
    sourcetype: z.ZodOptional<z.ZodString>;
    source: z.ZodOptional<z.ZodString>;
    host: z.ZodOptional<z.ZodString>;
    verifySsl: z.ZodDefault<z.ZodBoolean>;
    defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
}, "strip", z.ZodTypeAny, {
    type?: "splunk";
    name?: string;
    timeout?: number;
    token?: string;
    host?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    source?: string;
    index?: string;
    batchSize?: number;
    hecUrl?: string;
    sourcetype?: string;
    verifySsl?: boolean;
    defaultFields?: Record<string, string>;
}, {
    type?: "splunk";
    name?: string;
    timeout?: number;
    token?: string;
    host?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    enabled?: boolean;
    source?: string;
    index?: string;
    batchSize?: number;
    hecUrl?: string;
    sourcetype?: string;
    verifySsl?: boolean;
    defaultFields?: Record<string, string>;
}>, z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"elastic">;
    nodes: z.ZodArray<z.ZodString, "many">;
    auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
    apiKey: z.ZodOptional<z.ZodString>;
    username: z.ZodOptional<z.ZodString>;
    password: z.ZodOptional<z.ZodString>;
    bearerToken: z.ZodOptional<z.ZodString>;
    cloudId: z.ZodOptional<z.ZodString>;
    index: z.ZodString;
    pipeline: z.ZodOptional<z.ZodString>;
    verifySsl: z.ZodDefault<z.ZodBoolean>;
    refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
    caCert: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    type?: "elastic";
    name?: string;
    timeout?: number;
    password?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    pipeline?: string;
    refresh?: "true" | "false" | "wait_for";
    enabled?: boolean;
    username?: string;
    auth?: "none" | "apiKey" | "basic" | "bearer";
    index?: string;
    caCert?: string;
    batchSize?: number;
    verifySsl?: boolean;
    nodes?: string[];
    bearerToken?: string;
    cloudId?: string;
}, {
    type?: "elastic";
    name?: string;
    timeout?: number;
    password?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    pipeline?: string;
    refresh?: "true" | "false" | "wait_for";
    enabled?: boolean;
    username?: string;
    auth?: "none" | "apiKey" | "basic" | "bearer";
    index?: string;
    caCert?: string;
    batchSize?: number;
    verifySsl?: boolean;
    nodes?: string[];
    bearerToken?: string;
    cloudId?: string;
}>, z.ZodObject<{
    name: z.ZodString;
    enabled: z.ZodDefault<z.ZodBoolean>;
    timeout: z.ZodDefault<z.ZodNumber>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
    batchSize: z.ZodDefault<z.ZodNumber>;
} & {
    type: z.ZodLiteral<"datadog">;
    site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
    apiKey: z.ZodString;
    service: z.ZodString;
    source: z.ZodOptional<z.ZodString>;
    hostname: z.ZodOptional<z.ZodString>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    compress: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    type?: "datadog";
    name?: string;
    timeout?: number;
    service?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    tags?: string[];
    enabled?: boolean;
    source?: string;
    hostname?: string;
    batchSize?: number;
    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
    compress?: boolean;
}, {
    type?: "datadog";
    name?: string;
    timeout?: number;
    service?: string;
    apiKey?: string;
    maxRetries?: number;
    retryDelayMs?: number;
    maxRetryDelayMs?: number;
    tags?: string[];
    enabled?: boolean;
    source?: string;
    hostname?: string;
    batchSize?: number;
    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
    compress?: boolean;
}>]>;
/**
 * Event output format
 */
export declare const EventFormat: {
    readonly JSON: "json";
    readonly CEF: "cef";
    readonly SYSLOG: "syslog";
};
export type EventFormat = (typeof EventFormat)[keyof typeof EventFormat];
export declare const eventFormatSchema: z.ZodNativeEnum<{
    readonly JSON: "json";
    readonly CEF: "cef";
    readonly SYSLOG: "syslog";
}>;
/**
 * CEF format configuration
 */
export interface CEFConfig {
    /** CEF vendor name */
    vendor: string;
    /** CEF product name */
    product: string;
    /** CEF product version */
    version: string;
    /** Device event class ID prefix */
    deviceEventClassIdPrefix?: string;
}
export declare const cefConfigSchema: z.ZodObject<{
    vendor: z.ZodString;
    product: z.ZodString;
    version: z.ZodString;
    deviceEventClassIdPrefix: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    version?: string;
    vendor?: string;
    product?: string;
    deviceEventClassIdPrefix?: string;
}, {
    version?: string;
    vendor?: string;
    product?: string;
    deviceEventClassIdPrefix?: string;
}>;
/**
 * Syslog format configuration (RFC 5424)
 */
export interface SyslogConfig {
    /** Syslog facility (0-23) */
    facility: number;
    /** Application name */
    appName: string;
    /** Process ID */
    procId?: string;
    /** Message ID */
    msgId?: string;
    /** Include structured data */
    includeStructuredData?: boolean;
}
export declare const syslogConfigSchema: z.ZodObject<{
    facility: z.ZodNumber;
    appName: z.ZodString;
    procId: z.ZodOptional<z.ZodString>;
    msgId: z.ZodOptional<z.ZodString>;
    includeStructuredData: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    facility?: number;
    appName?: string;
    procId?: string;
    msgId?: string;
    includeStructuredData?: boolean;
}, {
    facility?: number;
    appName?: string;
    procId?: string;
    msgId?: string;
    includeStructuredData?: boolean;
}>;
/**
 * Geo-location enrichment configuration
 */
export interface GeoEnrichmentConfig {
    /** Whether geo enrichment is enabled */
    enabled: boolean;
    /** IP fields to enrich */
    ipFields?: string[];
    /** GeoIP database path */
    databasePath?: string;
    /** GeoIP service URL */
    serviceUrl?: string;
    /** Cache TTL in seconds */
    cacheTtlSeconds?: number;
}
export declare const geoEnrichmentConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    databasePath: z.ZodOptional<z.ZodString>;
    serviceUrl: z.ZodOptional<z.ZodString>;
    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    enabled?: boolean;
    cacheTtlSeconds?: number;
    ipFields?: string[];
    databasePath?: string;
    serviceUrl?: string;
}, {
    enabled?: boolean;
    cacheTtlSeconds?: number;
    ipFields?: string[];
    databasePath?: string;
    serviceUrl?: string;
}>;
/**
 * Threat intelligence enrichment configuration
 */
export interface ThreatEnrichmentConfig {
    /** Whether threat enrichment is enabled */
    enabled: boolean;
    /** Threat intel service URL */
    serviceUrl?: string;
    /** API key for threat intel service */
    apiKey?: string;
    /** Fields to check for indicators */
    indicatorFields?: string[];
    /** Cache TTL in seconds */
    cacheTtlSeconds?: number;
}
export declare const threatEnrichmentConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    serviceUrl: z.ZodOptional<z.ZodString>;
    apiKey: z.ZodOptional<z.ZodString>;
    indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    apiKey?: string;
    enabled?: boolean;
    cacheTtlSeconds?: number;
    serviceUrl?: string;
    indicatorFields?: string[];
}, {
    apiKey?: string;
    enabled?: boolean;
    cacheTtlSeconds?: number;
    serviceUrl?: string;
    indicatorFields?: string[];
}>;
/**
 * User context enrichment configuration
 */
export interface UserEnrichmentConfig {
    /** Whether user enrichment is enabled */
    enabled: boolean;
    /** User service URL */
    serviceUrl?: string;
    /** Include roles */
    includeRoles?: boolean;
    /** Include groups */
    includeGroups?: boolean;
    /** Include tenant info */
    includeTenant?: boolean;
    /** Cache TTL in seconds */
    cacheTtlSeconds?: number;
}
export declare const userEnrichmentConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    serviceUrl: z.ZodOptional<z.ZodString>;
    includeRoles: z.ZodDefault<z.ZodBoolean>;
    includeGroups: z.ZodDefault<z.ZodBoolean>;
    includeTenant: z.ZodDefault<z.ZodBoolean>;
    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    enabled?: boolean;
    cacheTtlSeconds?: number;
    serviceUrl?: string;
    includeRoles?: boolean;
    includeGroups?: boolean;
    includeTenant?: boolean;
}, {
    enabled?: boolean;
    cacheTtlSeconds?: number;
    serviceUrl?: string;
    includeRoles?: boolean;
    includeGroups?: boolean;
    includeTenant?: boolean;
}>;
/**
 * Combined enrichment configuration
 */
export interface EnrichmentConfig {
    /** Geo-location enrichment */
    geo?: GeoEnrichmentConfig;
    /** Threat intelligence enrichment */
    threat?: ThreatEnrichmentConfig;
    /** User context enrichment */
    user?: UserEnrichmentConfig;
    /** Field name normalization mapping */
    fieldNormalization?: Record<string, string>;
}
export declare const enrichmentConfigSchema: z.ZodObject<{
    geo: z.ZodOptional<z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
        databasePath: z.ZodOptional<z.ZodString>;
        serviceUrl: z.ZodOptional<z.ZodString>;
        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
    }, "strip", z.ZodTypeAny, {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        ipFields?: string[];
        databasePath?: string;
        serviceUrl?: string;
    }, {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        ipFields?: string[];
        databasePath?: string;
        serviceUrl?: string;
    }>>;
    threat: z.ZodOptional<z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        serviceUrl: z.ZodOptional<z.ZodString>;
        apiKey: z.ZodOptional<z.ZodString>;
        indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
    }, "strip", z.ZodTypeAny, {
        apiKey?: string;
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        indicatorFields?: string[];
    }, {
        apiKey?: string;
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        indicatorFields?: string[];
    }>>;
    user: z.ZodOptional<z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        serviceUrl: z.ZodOptional<z.ZodString>;
        includeRoles: z.ZodDefault<z.ZodBoolean>;
        includeGroups: z.ZodDefault<z.ZodBoolean>;
        includeTenant: z.ZodDefault<z.ZodBoolean>;
        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
    }, "strip", z.ZodTypeAny, {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        includeRoles?: boolean;
        includeGroups?: boolean;
        includeTenant?: boolean;
    }, {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        includeRoles?: boolean;
        includeGroups?: boolean;
        includeTenant?: boolean;
    }>>;
    fieldNormalization: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
}, "strip", z.ZodTypeAny, {
    user?: {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        includeRoles?: boolean;
        includeGroups?: boolean;
        includeTenant?: boolean;
    };
    geo?: {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        ipFields?: string[];
        databasePath?: string;
        serviceUrl?: string;
    };
    threat?: {
        apiKey?: string;
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        indicatorFields?: string[];
    };
    fieldNormalization?: Record<string, string>;
}, {
    user?: {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        includeRoles?: boolean;
        includeGroups?: boolean;
        includeTenant?: boolean;
    };
    geo?: {
        enabled?: boolean;
        cacheTtlSeconds?: number;
        ipFields?: string[];
        databasePath?: string;
        serviceUrl?: string;
    };
    threat?: {
        apiKey?: string;
        enabled?: boolean;
        cacheTtlSeconds?: number;
        serviceUrl?: string;
        indicatorFields?: string[];
    };
    fieldNormalization?: Record<string, string>;
}>;
/**
 * SIEM service configuration
 */
export interface SIEMConfig {
    /** List of connector configurations */
    connectors: ConnectorConfig[];
    /** Batch size for buffering */
    batchSize: number;
    /** Flush interval in milliseconds */
    flushIntervalMs: number;
    /** Enabled event types (empty = all) */
    enabledEventTypes: string[];
    /** Enrichment configuration */
    enrichment: EnrichmentConfig;
    /** Default event format */
    defaultFormat?: EventFormat;
    /** CEF configuration */
    cef?: CEFConfig;
    /** Syslog configuration */
    syslog?: SyslogConfig;
    /** Circuit breaker failure threshold */
    circuitBreakerThreshold?: number;
    /** Circuit breaker reset timeout in ms */
    circuitBreakerResetMs?: number;
    /** Whether to log events to console (for debugging) */
    debugLogging?: boolean;
    /** Redis key prefix for metrics */
    redisKeyPrefix?: string;
}
export declare const siemConfigSchema: z.ZodObject<{
    connectors: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
        name: z.ZodString;
        enabled: z.ZodDefault<z.ZodBoolean>;
        timeout: z.ZodDefault<z.ZodNumber>;
        maxRetries: z.ZodDefault<z.ZodNumber>;
        retryDelayMs: z.ZodDefault<z.ZodNumber>;
        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
        batchSize: z.ZodDefault<z.ZodNumber>;
    } & {
        type: z.ZodLiteral<"splunk">;
        hecUrl: z.ZodString;
        token: z.ZodString;
        index: z.ZodOptional<z.ZodString>;
        sourcetype: z.ZodOptional<z.ZodString>;
        source: z.ZodOptional<z.ZodString>;
        host: z.ZodOptional<z.ZodString>;
        verifySsl: z.ZodDefault<z.ZodBoolean>;
        defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    }, "strip", z.ZodTypeAny, {
        type?: "splunk";
        name?: string;
        timeout?: number;
        token?: string;
        host?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        enabled?: boolean;
        source?: string;
        index?: string;
        batchSize?: number;
        hecUrl?: string;
        sourcetype?: string;
        verifySsl?: boolean;
        defaultFields?: Record<string, string>;
    }, {
        type?: "splunk";
        name?: string;
        timeout?: number;
        token?: string;
        host?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        enabled?: boolean;
        source?: string;
        index?: string;
        batchSize?: number;
        hecUrl?: string;
        sourcetype?: string;
        verifySsl?: boolean;
        defaultFields?: Record<string, string>;
    }>, z.ZodObject<{
        name: z.ZodString;
        enabled: z.ZodDefault<z.ZodBoolean>;
        timeout: z.ZodDefault<z.ZodNumber>;
        maxRetries: z.ZodDefault<z.ZodNumber>;
        retryDelayMs: z.ZodDefault<z.ZodNumber>;
        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
        batchSize: z.ZodDefault<z.ZodNumber>;
    } & {
        type: z.ZodLiteral<"elastic">;
        nodes: z.ZodArray<z.ZodString, "many">;
        auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
        apiKey: z.ZodOptional<z.ZodString>;
        username: z.ZodOptional<z.ZodString>;
        password: z.ZodOptional<z.ZodString>;
        bearerToken: z.ZodOptional<z.ZodString>;
        cloudId: z.ZodOptional<z.ZodString>;
        index: z.ZodString;
        pipeline: z.ZodOptional<z.ZodString>;
        verifySsl: z.ZodDefault<z.ZodBoolean>;
        refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
        caCert: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        type?: "elastic";
        name?: string;
        timeout?: number;
        password?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        pipeline?: string;
        refresh?: "true" | "false" | "wait_for";
        enabled?: boolean;
        username?: string;
        auth?: "none" | "apiKey" | "basic" | "bearer";
        index?: string;
        caCert?: string;
        batchSize?: number;
        verifySsl?: boolean;
        nodes?: string[];
        bearerToken?: string;
        cloudId?: string;
    }, {
        type?: "elastic";
        name?: string;
        timeout?: number;
        password?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        pipeline?: string;
        refresh?: "true" | "false" | "wait_for";
        enabled?: boolean;
        username?: string;
        auth?: "none" | "apiKey" | "basic" | "bearer";
        index?: string;
        caCert?: string;
        batchSize?: number;
        verifySsl?: boolean;
        nodes?: string[];
        bearerToken?: string;
        cloudId?: string;
    }>, z.ZodObject<{
        name: z.ZodString;
        enabled: z.ZodDefault<z.ZodBoolean>;
        timeout: z.ZodDefault<z.ZodNumber>;
        maxRetries: z.ZodDefault<z.ZodNumber>;
        retryDelayMs: z.ZodDefault<z.ZodNumber>;
        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
        batchSize: z.ZodDefault<z.ZodNumber>;
    } & {
        type: z.ZodLiteral<"datadog">;
        site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
        apiKey: z.ZodString;
        service: z.ZodString;
        source: z.ZodOptional<z.ZodString>;
        hostname: z.ZodOptional<z.ZodString>;
        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        compress: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        type?: "datadog";
        name?: string;
        timeout?: number;
        service?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        tags?: string[];
        enabled?: boolean;
        source?: string;
        hostname?: string;
        batchSize?: number;
        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
        compress?: boolean;
    }, {
        type?: "datadog";
        name?: string;
        timeout?: number;
        service?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        tags?: string[];
        enabled?: boolean;
        source?: string;
        hostname?: string;
        batchSize?: number;
        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
        compress?: boolean;
    }>]>, "many">>;
    batchSize: z.ZodDefault<z.ZodNumber>;
    flushIntervalMs: z.ZodDefault<z.ZodNumber>;
    enabledEventTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    enrichment: z.ZodDefault<z.ZodObject<{
        geo: z.ZodOptional<z.ZodObject<{
            enabled: z.ZodDefault<z.ZodBoolean>;
            ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
            databasePath: z.ZodOptional<z.ZodString>;
            serviceUrl: z.ZodOptional<z.ZodString>;
            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
        }, "strip", z.ZodTypeAny, {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        }, {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        }>>;
        threat: z.ZodOptional<z.ZodObject<{
            enabled: z.ZodDefault<z.ZodBoolean>;
            serviceUrl: z.ZodOptional<z.ZodString>;
            apiKey: z.ZodOptional<z.ZodString>;
            indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
        }, "strip", z.ZodTypeAny, {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        }, {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        }>>;
        user: z.ZodOptional<z.ZodObject<{
            enabled: z.ZodDefault<z.ZodBoolean>;
            serviceUrl: z.ZodOptional<z.ZodString>;
            includeRoles: z.ZodDefault<z.ZodBoolean>;
            includeGroups: z.ZodDefault<z.ZodBoolean>;
            includeTenant: z.ZodDefault<z.ZodBoolean>;
            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
        }, "strip", z.ZodTypeAny, {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        }, {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        }>>;
        fieldNormalization: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    }, "strip", z.ZodTypeAny, {
        user?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        };
        geo?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        };
        threat?: {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        };
        fieldNormalization?: Record<string, string>;
    }, {
        user?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        };
        geo?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        };
        threat?: {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        };
        fieldNormalization?: Record<string, string>;
    }>>;
    defaultFormat: z.ZodOptional<z.ZodNativeEnum<{
        readonly JSON: "json";
        readonly CEF: "cef";
        readonly SYSLOG: "syslog";
    }>>;
    cef: z.ZodOptional<z.ZodObject<{
        vendor: z.ZodString;
        product: z.ZodString;
        version: z.ZodString;
        deviceEventClassIdPrefix: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        version?: string;
        vendor?: string;
        product?: string;
        deviceEventClassIdPrefix?: string;
    }, {
        version?: string;
        vendor?: string;
        product?: string;
        deviceEventClassIdPrefix?: string;
    }>>;
    syslog: z.ZodOptional<z.ZodObject<{
        facility: z.ZodNumber;
        appName: z.ZodString;
        procId: z.ZodOptional<z.ZodString>;
        msgId: z.ZodOptional<z.ZodString>;
        includeStructuredData: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        facility?: number;
        appName?: string;
        procId?: string;
        msgId?: string;
        includeStructuredData?: boolean;
    }, {
        facility?: number;
        appName?: string;
        procId?: string;
        msgId?: string;
        includeStructuredData?: boolean;
    }>>;
    circuitBreakerThreshold: z.ZodDefault<z.ZodNumber>;
    circuitBreakerResetMs: z.ZodDefault<z.ZodNumber>;
    debugLogging: z.ZodDefault<z.ZodBoolean>;
    redisKeyPrefix: z.ZodDefault<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    redisKeyPrefix?: string;
    flushIntervalMs?: number;
    batchSize?: number;
    cef?: {
        version?: string;
        vendor?: string;
        product?: string;
        deviceEventClassIdPrefix?: string;
    };
    syslog?: {
        facility?: number;
        appName?: string;
        procId?: string;
        msgId?: string;
        includeStructuredData?: boolean;
    };
    connectors?: ({
        type?: "splunk";
        name?: string;
        timeout?: number;
        token?: string;
        host?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        enabled?: boolean;
        source?: string;
        index?: string;
        batchSize?: number;
        hecUrl?: string;
        sourcetype?: string;
        verifySsl?: boolean;
        defaultFields?: Record<string, string>;
    } | {
        type?: "elastic";
        name?: string;
        timeout?: number;
        password?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        pipeline?: string;
        refresh?: "true" | "false" | "wait_for";
        enabled?: boolean;
        username?: string;
        auth?: "none" | "apiKey" | "basic" | "bearer";
        index?: string;
        caCert?: string;
        batchSize?: number;
        verifySsl?: boolean;
        nodes?: string[];
        bearerToken?: string;
        cloudId?: string;
    } | {
        type?: "datadog";
        name?: string;
        timeout?: number;
        service?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        tags?: string[];
        enabled?: boolean;
        source?: string;
        hostname?: string;
        batchSize?: number;
        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
        compress?: boolean;
    })[];
    enabledEventTypes?: string[];
    enrichment?: {
        user?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        };
        geo?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        };
        threat?: {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        };
        fieldNormalization?: Record<string, string>;
    };
    defaultFormat?: "json" | "cef" | "syslog";
    circuitBreakerThreshold?: number;
    circuitBreakerResetMs?: number;
    debugLogging?: boolean;
}, {
    redisKeyPrefix?: string;
    flushIntervalMs?: number;
    batchSize?: number;
    cef?: {
        version?: string;
        vendor?: string;
        product?: string;
        deviceEventClassIdPrefix?: string;
    };
    syslog?: {
        facility?: number;
        appName?: string;
        procId?: string;
        msgId?: string;
        includeStructuredData?: boolean;
    };
    connectors?: ({
        type?: "splunk";
        name?: string;
        timeout?: number;
        token?: string;
        host?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        enabled?: boolean;
        source?: string;
        index?: string;
        batchSize?: number;
        hecUrl?: string;
        sourcetype?: string;
        verifySsl?: boolean;
        defaultFields?: Record<string, string>;
    } | {
        type?: "elastic";
        name?: string;
        timeout?: number;
        password?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        pipeline?: string;
        refresh?: "true" | "false" | "wait_for";
        enabled?: boolean;
        username?: string;
        auth?: "none" | "apiKey" | "basic" | "bearer";
        index?: string;
        caCert?: string;
        batchSize?: number;
        verifySsl?: boolean;
        nodes?: string[];
        bearerToken?: string;
        cloudId?: string;
    } | {
        type?: "datadog";
        name?: string;
        timeout?: number;
        service?: string;
        apiKey?: string;
        maxRetries?: number;
        retryDelayMs?: number;
        maxRetryDelayMs?: number;
        tags?: string[];
        enabled?: boolean;
        source?: string;
        hostname?: string;
        batchSize?: number;
        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
        compress?: boolean;
    })[];
    enabledEventTypes?: string[];
    enrichment?: {
        user?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            includeRoles?: boolean;
            includeGroups?: boolean;
            includeTenant?: boolean;
        };
        geo?: {
            enabled?: boolean;
            cacheTtlSeconds?: number;
            ipFields?: string[];
            databasePath?: string;
            serviceUrl?: string;
        };
        threat?: {
            apiKey?: string;
            enabled?: boolean;
            cacheTtlSeconds?: number;
            serviceUrl?: string;
            indicatorFields?: string[];
        };
        fieldNormalization?: Record<string, string>;
    };
    defaultFormat?: "json" | "cef" | "syslog";
    circuitBreakerThreshold?: number;
    circuitBreakerResetMs?: number;
    debugLogging?: boolean;
}>;
/**
 * Default SIEM configuration
 */
export declare const DEFAULT_SIEM_CONFIG: Partial<SIEMConfig>;
/**
 * SIEM connector metrics
 */
export interface SIEMMetrics {
    /** Total events sent */
    eventsSent: number;
    /** Total events failed */
    eventsFailed: number;
    /** Total batches sent */
    batchesSent: number;
    /** Total batches failed */
    batchesFailed: number;
    /** Average latency in ms */
    avgLatencyMs: number;
    /** Events in current buffer */
    bufferSize: number;
    /** Connector status by name */
    connectorStatus: Record<string, 'connected' | 'disconnected' | 'circuit_open'>;
    /** Last send timestamp */
    lastSendTime?: Date;
    /** Last error */
    lastError?: string;
}
/**
 * Event filter function
 */
export type EventFilter = (event: SecurityEvent) => boolean;
/**
 * Event transformer function
 */
export type EventTransformer = (event: SecurityEvent) => SecurityEvent;
/**
 * Hook for integration with other systems
 */
export interface IntegrationHook {
    /** Hook name */
    name: string;
    /** Event types to handle (empty = all) */
    eventTypes: string[];
    /** Filter function */
    filter?: EventFilter;
    /** Transformer function */
    transformer?: EventTransformer;
    /** Whether hook is enabled */
    enabled: boolean;
}
//# sourceMappingURL=types.d.ts.map