/**
 * SIEM Connector Framework
 *
 * Enterprise SIEM (Security Information and Event Management) integration
 * framework supporting multiple SIEM platforms:
 * - Splunk (HTTP Event Collector)
 * - Elasticsearch/OpenSearch
 * - Datadog
 *
 * Features:
 * - Multiple connector support with fan-out
 * - Event buffering and batching
 * - Circuit breaker per connector
 * - Event enrichment (geo, threat intel, user context)
 * - Multiple output formats (JSON, CEF, Syslog)
 * - Integration hooks for alerts, audit, anomalies
 *
 * @example
 * ```typescript
 * import {
 *   getSIEMService,
 *   registerStandardHooks,
 *   forwardSecurityAlert,
 * } from './security/siem';
 *
 * // Get the SIEM service
 * const siemService = getSIEMService({
 *   connectors: [
 *     {
 *       type: 'splunk',
 *       name: 'splunk-prod',
 *       enabled: true,
 *       hecUrl: 'https://splunk.example.com:8088',
 *       token: 'your-hec-token',
 *       index: 'security',
 *       sourcetype: 'vorion:security',
 *     },
 *   ],
 *   batchSize: 100,
 *   flushIntervalMs: 5000,
 * });
 *
 * // Register standard hooks
 * registerStandardHooks(siemService);
 *
 * // Connect all connectors
 * await siemService.connectAll();
 *
 * // Send an event
 * await siemService.send({
 *   id: 'event-123',
 *   timestamp: new Date(),
 *   eventType: 'login.failed',
 *   category: 'authentication',
 *   severity: 4,
 *   outcome: 'failure',
 *   message: 'Failed login attempt',
 *   sourceIp: '192.168.1.100',
 *   user: { userId: 'user-123' },
 *   source: 'vorion',
 * });
 *
 * // Or forward security alerts
 * await forwardSecurityAlert(siemService, alert);
 * ```
 *
 * @packageDocumentation
 * @module security/siem
 */
export type { SecurityEvent, SendResult, GeoLocation, ThreatContext, UserContext, BaseConnectorConfig, SplunkConnectorConfig, ElasticConnectorConfig, DatadogConnectorConfig, ConnectorConfig, CEFConfig, SyslogConfig, GeoEnrichmentConfig, ThreatEnrichmentConfig, UserEnrichmentConfig, EnrichmentConfig, SIEMConfig, SIEMMetrics, IntegrationHook, EventFilter, EventTransformer, } from './types.js';
export { EventSeverity, EventCategory, EventOutcome, EventFormat, DEFAULT_SIEM_CONFIG, } from './types.js';
export type { SIEMConnector, ConnectorFactory } from './connector.js';
export { BaseSIEMConnector, registerConnectorFactory, getConnectorFactory, getRegisteredConnectorTypes, } from './connector.js';
export { SplunkConnector, createSplunkConnector } from './splunk.js';
export { ElasticConnector, createElasticConnector } from './elastic.js';
export { DatadogConnector, createDatadogConnector } from './datadog.js';
export { EventFormatter, FieldNormalizer, createEventFormatter, createFieldNormalizer, getDefaultFormatter, configureDefaultFormatter, } from './formatter.js';
export type { EnrichmentResult, GeoEnrichmentProvider, ThreatEnrichmentProvider, UserEnrichmentProvider, } from './enrichment.js';
export { EventEnricher, DefaultGeoProvider, DefaultThreatProvider, DefaultUserProvider, createEventEnricher, createNoOpEnricher, } from './enrichment.js';
export { SIEMService, getSIEMService, resetSIEMService, createSIEMService, } from './service.js';
export type { SecurityAlertHookConfig, AuditLogHookConfig, AnomalyHookConfig, } from './hooks.js';
export { createSecurityAlertHook, createAuditLogHook, createAnomalyHook, securityAlertToEvent, auditRecordToEvent, anomalyToEvent, registerStandardHooks, forwardSecurityAlert, forwardAuditRecord, forwardAnomaly, } from './hooks.js';
//# sourceMappingURL=index.d.ts.map