import type { Detector, DetectionResult, SecurityEvent } from '../types.js';
/**
 * Configuration for privilege escalation detection
 */
export interface PrivilegeEscalationDetectorConfig {
    /** Normal business hours start (0-23) */
    normalHoursStart: number;
    /** Normal business hours end (0-23) */
    normalHoursEnd: number;
    /** High-risk permission patterns (regex) */
    highRiskPermissions: string[];
    /** Admin/elevated roles to flag */
    elevatedRoles: string[];
    /** Maximum permission grants per day before alerting */
    maxDailyGrants: number;
    /** Whether to compare against peer group */
    enablePeerGroupComparison: boolean;
    /** Sensitivity levels for different resource types */
    resourceSensitivity: Record<string, number>;
}
export declare const DEFAULT_PRIVILEGE_ESCALATION_CONFIG: PrivilegeEscalationDetectorConfig;
/**
 * User's privilege baseline
 */
interface PrivilegeBaseline {
    userId: string;
    role?: string;
    /** Permission grant frequency histogram by hour */
    grantHourHistogram: number[];
    /** Day of week histogram for grants */
    grantDayHistogram: number[];
    /** Common approvers for this user */
    commonApprovers: Record<string, number>;
    /** Typical resource access levels */
    typicalResourceLevels: Record<string, number>;
    /** Total permission change events */
    totalEvents: number;
    /** Recent grant count (rolling 24h) */
    recentGrantCount: number;
    /** Last updated timestamp */
    lastUpdated: string;
}
/**
 * Privilege escalation anomaly detector
 */
export declare class PrivilegeEscalationDetector implements Detector {
    readonly name = "privilege-escalation";
    readonly description = "Detects unusual permission grants, role changes, and access to elevated resources";
    private readonly config;
    private readonly redis;
    private readonly keyPrefix;
    constructor(config?: Partial<PrivilegeEscalationDetectorConfig>, keyPrefix?: string);
    /**
     * Analyze an event for privilege escalation anomalies
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Learn from an event by updating baselines
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines
     */
    reset(): Promise<void>;
    /**
     * Get baseline for a specific user
     */
    getBaseline(userId: string): Promise<PrivilegeBaseline>;
    /**
     * Update baseline for a user based on a security event
     */
    updateBaseline(userId: string, event: SecurityEvent): Promise<void>;
    /**
     * Check if event is privilege-related
     */
    private isPrivilegeEvent;
    /**
     * Check for unusual permission grants
     */
    private checkUnusualPermissionGrant;
    /**
     * Check for role changes outside normal patterns
     */
    private checkRoleChangePattern;
    /**
     * Check for access to resources above typical level
     */
    private checkElevatedAccess;
    /**
     * Check for time-based anomalies
     */
    private checkTimeAnomaly;
    /**
     * Check for anomalous approver patterns
     */
    private checkApproverAnomaly;
    /**
     * Check against peer group baseline
     */
    private checkAgainstPeerGroup;
    /**
     * Update user's privilege baseline
     */
    private updateUserBaseline;
    /**
     * Update role change history
     */
    private updateRoleHistory;
    /**
     * Update approver patterns
     */
    private updateApproverPattern;
    /**
     * Update peer group baseline
     */
    private updatePeerGroupBaseline;
    /**
     * Get peer group baseline
     */
    private getPeerGroupBaseline;
    /**
     * Get recent role changes for a user
     */
    private getRecentRoleChanges;
    /**
     * Get daily grant count for a user
     */
    private getDailyGrantCount;
    /**
     * Increment daily grant count
     */
    private incrementDailyGrantCount;
    /**
     * Get resource sensitivity level
     */
    private getResourceSensitivity;
    /**
     * Create empty baseline for new user
     */
    private createEmptyBaseline;
    /**
     * Calculate combined risk score
     */
    private calculateRiskScore;
    /**
     * Generate human-readable description
     */
    private generateDescription;
    /**
     * Create a detection result
     */
    private createResult;
    /**
     * Delete keys matching a pattern
     */
    private deleteKeysByPattern;
}
/**
 * Create a new privilege escalation detector instance
 */
export declare function createPrivilegeEscalationDetector(config?: Partial<PrivilegeEscalationDetectorConfig>, keyPrefix?: string): PrivilegeEscalationDetector;
export {};
//# sourceMappingURL=privilege-escalation.d.ts.map