import type { AuditEvent, ISIEMConnector, SIEMConfig, SIEMConnectorStats, SIEMProvider } from './types.js';
/**
 * Unified SIEM connector that provides a single interface for all providers.
 *
 * This is the main entry point for SIEM integration. It handles:
 * - Configuration validation
 * - Provider-specific connector initialization
 * - Event validation before sending
 * - Graceful shutdown coordination
 *
 * @example
 * ```typescript
 * const siem = new SIEMConnector({
 *   enabled: true,
 *   provider: 'loki',
 *   endpoint: 'http://loki:3100',
 * });
 *
 * await siem.initialize();
 * await siem.sendEvent(auditEvent);
 * await siem.shutdown();
 * ```
 */
export declare class SIEMConnector implements ISIEMConnector {
    readonly provider: SIEMProvider;
    private config;
    private connector;
    private isInitialized;
    /**
     * Create a new SIEM connector
     *
     * @param config - SIEM configuration (will be validated with Zod)
     * @throws SIEMConfigurationError if configuration is invalid
     */
    constructor(config: Partial<SIEMConfig> & {
        endpoint: string;
    });
    /**
     * Initialize the provider-specific connector
     *
     * Must be called before sending events.
     *
     * @throws SIEMConfigurationError if initialization fails
     */
    initialize(): Promise<void>;
    /**
     * Check if the SIEM provider is healthy
     */
    healthCheck(): Promise<boolean>;
    /**
     * Send a single audit event to the SIEM
     *
     * @param event - The audit event to send
     * @throws Error if connector not initialized or event validation fails
     */
    sendEvent(event: AuditEvent): Promise<void>;
    /**
     * Send a batch of audit events to the SIEM
     *
     * @param events - Array of audit events to send
     */
    sendBatch(events: AuditEvent[]): Promise<void>;
    /**
     * Flush any buffered events
     */
    flush(): Promise<void>;
    /**
     * Gracefully shutdown the connector
     *
     * Flushes any buffered events before closing.
     */
    shutdown(): Promise<void>;
    /**
     * Get connector statistics
     */
    getStats(): SIEMConnectorStats;
    /**
     * Check if the connector is enabled
     */
    isEnabled(): boolean;
    /**
     * Get the current configuration
     */
    getConfig(): Readonly<SIEMConfig>;
}
/**
 * Create a SIEM connector from environment variables
 *
 * Environment variables:
 * - VORION_SIEM_ENABLED: Enable SIEM integration (true/false)
 * - VORION_SIEM_PROVIDER: Provider type (loki, splunk, elastic)
 * - VORION_SIEM_ENDPOINT: Provider endpoint URL
 * - VORION_SIEM_AUTH_TYPE: Authentication type (none, basic, bearer, api-key)
 * - VORION_SIEM_AUTH_USERNAME: Username for basic auth
 * - VORION_SIEM_AUTH_PASSWORD: Password for basic auth
 * - VORION_SIEM_AUTH_TOKEN: Token for bearer auth
 * - VORION_SIEM_AUTH_API_KEY: API key for api-key auth
 * - VORION_SIEM_BATCH_SIZE: Events per batch
 * - VORION_SIEM_FLUSH_INTERVAL_MS: Flush interval in ms
 * - VORION_SIEM_RETRY_ATTEMPTS: Number of retry attempts
 * - VORION_SIEM_EVENT_TYPES: Comma-separated list of event types to send
 * - VORION_SIEM_APP_LABEL: Application label
 * - VORION_SIEM_ENVIRONMENT_LABEL: Environment label
 */
export declare function createSIEMConnectorFromEnv(): SIEMConnector;
/**
 * Create a SIEM connector with minimal configuration (Loki)
 *
 * @param endpoint - Loki endpoint URL
 * @param options - Optional configuration overrides
 */
export declare function createLokiSIEM(endpoint: string, options?: Partial<SIEMConfig>): SIEMConnector;
/**
 * Create a SIEM connector with minimal configuration (Splunk)
 *
 * @param endpoint - Splunk HEC endpoint URL
 * @param token - HEC token
 * @param options - Optional configuration overrides
 */
export declare function createSplunkSIEM(endpoint: string, token: string, options?: Partial<SIEMConfig>): SIEMConnector;
/**
 * Create a SIEM connector with minimal configuration (Elasticsearch)
 *
 * @param endpoint - Elasticsearch endpoint URL
 * @param options - Optional configuration overrides
 */
export declare function createElasticSIEM(endpoint: string, options?: Partial<SIEMConfig>): SIEMConnector;
export { LokiConnector, createLokiConnector } from './loki.js';
export { SplunkConnector, createSplunkConnector } from './splunk.js';
export { ElasticConnector, createElasticConnector } from './elastic.js';
export type { SIEMConfig, SIEMProvider, AuthType, AuditEvent, AuditEventActor, AuditEventResource, AuditEventMetadata, ISIEMConnector, SIEMConnectorStats, SIEMEventCategory, SIEMEventSeverity, SIEMEventOutcome, SIEMAuditEventType, LokiPushRequest, LokiStream, LokiLogEntry, SplunkHECEvent, ElasticBulkAction, ElasticAuditDocument, } from './types.js';
export { SIEMConfigSchema, SIEMAuthenticationSchema, AuditEventSchema, AuditEventActorSchema, AuditEventResourceSchema, AuditEventMetadataSchema, SIEM_PROVIDERS, AUTH_TYPES, SIEM_EVENT_CATEGORIES, SIEM_EVENT_SEVERITIES, SIEM_EVENT_OUTCOMES, SIEM_EVENT_TYPES, SIEMConnectionError, SIEMConfigurationError, SIEMBatchError, } from './types.js';
//# sourceMappingURL=index.d.ts.map