/**
 * Security Alert Detector
 *
 * Detects security events and triggers alerts based on configurable rules.
 * Built-in detection for common security threats:
 * - Brute force attacks
 * - Credential stuffing
 * - Privilege escalation attempts
 * - Unusual access patterns
 * - API key abuse
 * - Security configuration changes
 *
 * @packageDocumentation
 * @module security/alerting/detector
 */
import type { Redis } from 'ioredis';
import { type AlertRule, type CreateAlertInput, type AlertContext, AlertSeverity, SecurityEventType } from './types.js';
/**
 * Security event for detection
 */
export interface DetectorSecurityEvent {
    /** Event type */
    type: SecurityEventType;
    /** Event context */
    context: AlertContext;
    /** When the event occurred */
    timestamp: Date;
    /** Whether the action was successful */
    success: boolean;
    /** Additional event data */
    data?: Record<string, unknown>;
}
/**
 * Detection result
 */
export interface DetectionResult {
    /** Whether an alert should be triggered */
    shouldAlert: boolean;
    /** The alert to create (if shouldAlert is true) */
    alert?: CreateAlertInput;
    /** Which rule triggered the alert */
    triggeredRule?: AlertRule;
    /** Reason for detection/non-detection */
    reason: string;
}
/**
 * Configuration for built-in detection rules
 */
export interface BuiltInDetectorConfig {
    /** Brute force detection */
    bruteForce: {
        enabled: boolean;
        maxAttempts: number;
        windowSeconds: number;
        severity: AlertSeverity;
    };
    /** Credential stuffing detection */
    credentialStuffing: {
        enabled: boolean;
        minUniqueUsers: number;
        maxUniquePasswords: number;
        windowSeconds: number;
        severity: AlertSeverity;
    };
    /** Privilege escalation detection */
    privilegeEscalation: {
        enabled: boolean;
        severity: AlertSeverity;
    };
    /** Unusual access patterns */
    unusualAccess: {
        enabled: boolean;
        geoAnomalyEnabled: boolean;
        timeAnomalyEnabled: boolean;
        severity: AlertSeverity;
        normalHoursStart: number;
        normalHoursEnd: number;
        normalDays: number[];
    };
    /** API key abuse detection */
    apiKeyAbuse: {
        enabled: boolean;
        rateLimitHitsThreshold: number;
        windowSeconds: number;
        severity: AlertSeverity;
    };
    /** Security configuration changes */
    configChanges: {
        enabled: boolean;
        severity: AlertSeverity;
    };
}
/**
 * Default built-in detector configuration
 */
export declare const DEFAULT_BUILTIN_DETECTOR_CONFIG: BuiltInDetectorConfig;
/**
 * Detects security events and determines when alerts should be triggered
 */
export declare class SecurityAlertDetector {
    private readonly redis;
    private readonly customRules;
    private readonly builtInConfig;
    private readonly keyPrefix;
    constructor(options?: {
        redis?: Redis;
        builtInConfig?: Partial<BuiltInDetectorConfig>;
        keyPrefix?: string;
    });
    /**
     * Process a security event and determine if alerts should be triggered
     */
    detect(event: DetectorSecurityEvent): Promise<DetectionResult[]>;
    /**
     * Add a custom alert rule
     */
    addRule(rule: AlertRule): void;
    /**
     * Remove a custom alert rule
     */
    removeRule(ruleId: string): boolean;
    /**
     * Get all custom rules
     */
    getRules(): AlertRule[];
    /**
     * Check if an alert is in cooldown
     */
    isInCooldown(fingerprint: string): Promise<boolean>;
    /**
     * Set cooldown for an alert
     */
    setCooldown(fingerprint: string, seconds: number): Promise<void>;
    /**
     * Get current counter value
     */
    getCounter(key: string): Promise<number>;
    private runBuiltInDetectors;
    /**
     * Detect brute force attacks
     * Triggers when N failed logins occur in M minutes for the same identifier
     */
    private detectBruteForce;
    /**
     * Detect credential stuffing attacks
     * Many different users with few unique passwords from same source
     */
    private detectCredentialStuffing;
    /**
     * Detect privilege escalation attempts
     */
    private detectPrivilegeEscalation;
    /**
     * Detect unusual access patterns (geo anomaly, time anomaly)
     */
    private detectUnusualAccess;
    /**
     * Detect API key abuse (excessive rate limit hits)
     */
    private detectApiKeyAbuse;
    /**
     * Detect security configuration changes
     */
    private detectConfigChange;
    private runCustomRules;
    private evaluateConditions;
    private getFieldValue;
    private evaluateCondition;
    private checkThreshold;
    private createAlertFromRule;
    private applyTemplate;
    /**
     * Increment a sliding window counter and return the new count
     */
    private incrementSlidingWindowCounter;
    /**
     * Generate a fingerprint for deduplication
     */
    private generateFingerprint;
    /**
     * Generate a fingerprint for a rule match
     */
    private generateRuleFingerprint;
    /**
     * Get the built-in configuration
     */
    getBuiltInConfig(): BuiltInDetectorConfig;
    /**
     * Update built-in configuration
     */
    updateBuiltInConfig(config: Partial<BuiltInDetectorConfig>): void;
    /**
     * Reset all counters (primarily for testing)
     */
    resetCounters(): Promise<void>;
}
/**
 * Options for creating a SecurityAlertDetector
 */
export interface SecurityAlertDetectorOptions {
    redis?: Redis;
    builtInConfig?: Partial<BuiltInDetectorConfig>;
    keyPrefix?: string;
}
/**
 * Get or create the singleton SecurityAlertDetector instance
 */
export declare function getSecurityAlertDetector(options?: SecurityAlertDetectorOptions): SecurityAlertDetector;
/**
 * Reset the singleton instance (primarily for testing)
 */
export declare function resetSecurityAlertDetector(): void;
/**
 * Create a new SecurityAlertDetector instance
 */
export declare function createSecurityAlertDetector(options?: SecurityAlertDetectorOptions): SecurityAlertDetector;
//# sourceMappingURL=detector.d.ts.map