import type { SIEMService } from './service.js';
import type { SecurityEvent, IntegrationHook } from './types.js';
import type { SecurityAlert } from '../alerting/types.js';
import type { Anomaly } from '../anomaly/types.js';
import type { AuditRecord } from '../../audit/types.js';
/**
 * Configuration for security alert hook
 */
export interface SecurityAlertHookConfig {
    /** Only forward alerts with these severities */
    severities?: string[];
    /** Only forward alerts with these types */
    alertTypes?: string[];
    /** Include raw alert data */
    includeRawData?: boolean;
    /** Additional tags to add */
    additionalTags?: string[];
}
/**
 * Create a hook for forwarding security alerts to SIEM
 */
export declare function createSecurityAlertHook(config?: SecurityAlertHookConfig): IntegrationHook;
/**
 * Convert a SecurityAlert to a SecurityEvent for SIEM
 */
export declare function securityAlertToEvent(alert: SecurityAlert): SecurityEvent;
/**
 * Configuration for audit log hook
 */
export interface AuditLogHookConfig {
    /** Only forward audit logs with these categories */
    categories?: string[];
    /** Only forward audit logs with these severities */
    severities?: string[];
    /** Only forward audit logs with these outcomes */
    outcomes?: string[];
    /** Exclude certain event types */
    excludeEventTypes?: string[];
    /** Include state change data */
    includeStateChange?: boolean;
    /** Additional tags to add */
    additionalTags?: string[];
}
/**
 * Create a hook for forwarding audit logs to SIEM
 */
export declare function createAuditLogHook(config?: AuditLogHookConfig): IntegrationHook;
/**
 * Convert an AuditRecord to a SecurityEvent for SIEM
 */
export declare function auditRecordToEvent(record: AuditRecord): SecurityEvent;
/**
 * Configuration for anomaly detection hook
 */
export interface AnomalyHookConfig {
    /** Only forward anomalies with these types */
    anomalyTypes?: string[];
    /** Minimum confidence threshold (0-100) */
    minConfidence?: number;
    /** Only forward anomalies with these severities */
    severities?: string[];
    /** Include indicators */
    includeIndicators?: boolean;
    /** Additional tags to add */
    additionalTags?: string[];
}
/**
 * Create a hook for forwarding anomaly detections to SIEM
 */
export declare function createAnomalyHook(config?: AnomalyHookConfig): IntegrationHook;
/**
 * Convert an Anomaly to a SecurityEvent for SIEM
 */
export declare function anomalyToEvent(anomaly: Anomaly): SecurityEvent;
/**
 * Register standard hooks with a SIEM service
 */
export declare function registerStandardHooks(siemService: SIEMService, config?: {
    alerts?: SecurityAlertHookConfig | false;
    audit?: AuditLogHookConfig | false;
    anomaly?: AnomalyHookConfig | false;
}): void;
/**
 * Forward a security alert to SIEM
 */
export declare function forwardSecurityAlert(siemService: SIEMService, alert: SecurityAlert): Promise<void>;
/**
 * Forward an audit record to SIEM
 */
export declare function forwardAuditRecord(siemService: SIEMService, record: AuditRecord): Promise<void>;
/**
 * Forward an anomaly to SIEM
 */
export declare function forwardAnomaly(siemService: SIEMService, anomaly: Anomaly): Promise<void>;
//# sourceMappingURL=hooks.d.ts.map