/**
 * Alert Management
 * Trust score degradation, breach notifications, compliance expiration, and SIEM integration
 */
import { Alert, AlertType, AlertSeverity, AlertStatus, AlertAction, HealthEvent, TrustScore, ComplianceCertification, Contract, VendorInfo, PaginatedResponse } from './types';
export interface AlertManagerConfig {
    storage: AlertStorage;
    notificationChannels: NotificationChannel[];
    siemIntegration?: SIEMIntegration;
    escalationPolicies: EscalationPolicy[];
    deduplicationWindow: number;
    autoResolveEnabled: boolean;
}
export interface EscalationPolicy {
    name: string;
    conditions: EscalationCondition[];
    actions: EscalationAction[];
}
export interface EscalationCondition {
    field: 'severity' | 'type' | 'age' | 'vendorTier';
    operator: 'eq' | 'neq' | 'gt' | 'lt' | 'in';
    value: unknown;
}
export interface EscalationAction {
    type: 'notify' | 'assign' | 'change_severity' | 'create_incident';
    config: Record<string, unknown>;
}
export declare class AlertManager {
    private readonly config;
    private readonly recentAlerts;
    constructor(config: AlertManagerConfig);
    createAlert(input: CreateAlertInput): Promise<Alert>;
    createAlertFromHealthEvent(event: HealthEvent, vendor: VendorInfo): Promise<Alert | null>;
    createTrustScoreDegradationAlert(vendorId: string, vendor: VendorInfo, previousScore: TrustScore, currentScore: TrustScore): Promise<Alert>;
    createComplianceExpirationAlert(vendorId: string, vendor: VendorInfo, certification: ComplianceCertification, daysUntilExpiration: number): Promise<Alert>;
    createContractExpirationAlert(vendorId: string, vendor: VendorInfo, contract: Contract, daysUntilExpiration: number): Promise<Alert>;
    createBreachAlert(vendorId: string, vendor: VendorInfo, breach: BreachAlertInput): Promise<Alert>;
    getAlert(alertId: string): Promise<Alert>;
    updateAlert(alertId: string, updates: UpdateAlertInput): Promise<Alert>;
    acknowledgeAlert(alertId: string, acknowledgedBy: string): Promise<Alert>;
    resolveAlert(alertId: string, resolution: AlertResolution): Promise<Alert>;
    suppressAlert(alertId: string, reason: string, duration: number): Promise<Alert>;
    assignAlert(alertId: string, assignee: string): Promise<Alert>;
    addComment(alertId: string, comment: AlertComment): Promise<void>;
    listAlerts(options: ListAlertsOptions): Promise<PaginatedResponse<Alert>>;
    getVendorAlerts(vendorId: string, options?: ListAlertsOptions): Promise<Alert[]>;
    getOpenAlerts(options?: ListAlertsOptions): Promise<Alert[]>;
    getAlertsByType(type: AlertType, options?: ListAlertsOptions): Promise<Alert[]>;
    getAlertStats(vendorId?: string): Promise<AlertStats>;
    bulkAcknowledge(alertIds: string[], acknowledgedBy: string): Promise<Alert[]>;
    bulkResolve(alertIds: string[], resolution: AlertResolution): Promise<Alert[]>;
    autoResolveStaleAlerts(maxAgeHours: number): Promise<number>;
    private sendNotifications;
    private shouldNotifyChannel;
    private sendNotificationToChannel;
    private formatNotificationPayload;
    private sendEmailNotification;
    private sendSlackNotification;
    private sendTeamsNotification;
    private sendPagerDutyNotification;
    private sendWebhookNotification;
    private sendToSIEM;
    private formatSIEMEvent;
    private mapSeverityToSIEM;
    private extractIndicators;
    private checkEscalationPolicies;
    private matchesEscalationConditions;
    private matchesCondition;
    private executeEscalationActions;
    private escalationNotify;
    private createIncident;
    private generateAlertId;
    private generateDedupeKey;
    private isWithinDedupeWindow;
    private generateAlertActions;
    private mapHealthEventToAlertType;
    private mapEventSeverityToAlertSeverity;
    private calculateDegradationSeverity;
    private calculateBreachSeverity;
    private getSeverityColor;
    private mapSeverityToPagerDuty;
}
export interface CreateAlertInput {
    vendorId: string;
    type: AlertType;
    severity: AlertSeverity;
    title: string;
    description: string;
    source: string;
    relatedEvents?: string[];
    metadata?: Record<string, unknown>;
}
export interface UpdateAlertInput {
    severity?: AlertSeverity;
    status?: AlertStatus;
    assignee?: string;
    acknowledgedAt?: Date;
    resolvedAt?: Date;
    relatedEvents?: string[];
    metadata?: Record<string, unknown>;
}
export interface AlertResolution {
    type: 'resolved' | 'false_positive' | 'accepted_risk' | 'auto_resolved';
    reason: string;
    resolvedBy: string;
    notes?: string;
}
export interface AlertComment {
    author: string;
    content: string;
    createdAt: Date;
}
export interface ListAlertsOptions {
    vendorId?: string;
    types?: AlertType[];
    severities?: AlertSeverity[];
    statuses?: AlertStatus[];
    startDate?: Date;
    endDate?: Date;
    page?: number;
    pageSize?: number;
    sortBy?: string;
    sortOrder?: 'asc' | 'desc';
}
export interface AlertStats {
    total: number;
    open: number;
    acknowledged: number;
    investigating: number;
    resolved: number;
    suppressed: number;
    bySeverity: Record<AlertSeverity, number>;
    byType: Record<AlertType, number>;
    averageResolutionTime: number;
    mttr: number;
}
export interface BreachAlertInput {
    breachId: string;
    breachDate: Date;
    disclosureDate: Date;
    description: string;
    source: string;
    recordsAffected?: number;
    dataTypes: string[];
}
export interface NotificationChannel {
    id: string;
    name: string;
    type: 'email' | 'slack' | 'teams' | 'pagerduty' | 'webhook';
    enabled: boolean;
    minSeverity?: AlertSeverity;
    alertTypes?: AlertType[];
    config: Record<string, unknown>;
}
export interface NotificationPayload {
    title: string;
    description: string;
    severity: AlertSeverity;
    type: AlertType;
    vendorId: string;
    alertId: string;
    createdAt: Date;
    source: string;
    actions: AlertAction[];
    metadata: Record<string, unknown>;
}
export interface SIEMIntegration {
    type: 'splunk' | 'elastic' | 'sentinel' | 'qradar' | 'custom';
    config: Record<string, unknown>;
    sendEvent(event: SIEMEvent): Promise<void>;
}
export interface SIEMEvent {
    timestamp: Date;
    eventType: string;
    severity: number;
    source: string;
    category: string;
    subcategory: string;
    description: string;
    details: Record<string, unknown>;
    indicators: SIEMIndicator[];
}
export interface SIEMIndicator {
    type: 'ip' | 'domain' | 'hash' | 'email' | 'url';
    value: string;
    confidence: 'high' | 'medium' | 'low';
}
export interface AlertStorage {
    saveAlert(alert: Alert): Promise<void>;
    getAlert(alertId: string): Promise<Alert | null>;
    listAlerts(options: ListAlertsOptions): Promise<PaginatedResponse<Alert>>;
    getStaleAlerts(maxAgeHours: number): Promise<Alert[]>;
    getAlertStats(vendorId?: string): Promise<AlertStats>;
    addAlertComment(alertId: string, comment: AlertComment): Promise<void>;
}
export declare class AlertError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
export declare function createAlertManager(config: AlertManagerConfig): AlertManager;
export declare function getDefaultEscalationPolicies(): EscalationPolicy[];
//# sourceMappingURL=alerts.d.ts.map