import { z } from 'zod';
/**
 * US-CERT Incident Categories (CAT 1-6)
 *
 * CAT 1: Unauthorized Access - Highest priority
 * CAT 2: Denial of Service
 * CAT 3: Malicious Code
 * CAT 4: Improper Usage
 * CAT 5: Scans/Probes/Attempted Access
 * CAT 6: Investigation (unconfirmed incidents)
 */
export declare const INCIDENT_CATEGORIES: readonly ["CAT-1", "CAT-2", "CAT-3", "CAT-4", "CAT-5", "CAT-6"];
export type IncidentCategory = (typeof INCIDENT_CATEGORIES)[number];
/**
 * Incident category definitions
 */
export declare const INCIDENT_CATEGORY_DEFINITIONS: Record<IncidentCategory, {
    name: string;
    description: string;
    reportingTimeframe: string;
    reportingTimeframeHours: number;
    examples: string[];
}>;
/**
 * Incident status
 */
export declare const INCIDENT_STATUSES: readonly ["detected", "reported", "investigating", "contained", "eradicated", "recovering", "closed", "post-incident-review"];
export type IncidentStatus = (typeof INCIDENT_STATUSES)[number];
/**
 * Notification recipients
 */
export declare const NOTIFICATION_RECIPIENTS: readonly ["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"];
export type NotificationRecipient = (typeof NOTIFICATION_RECIPIENTS)[number];
/**
 * Evidence type
 */
export declare const EVIDENCE_TYPES: readonly ["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"];
export type EvidenceType = (typeof EVIDENCE_TYPES)[number];
/**
 * Preserved evidence record
 */
export interface PreservedEvidence {
    /** Unique identifier */
    id: string;
    /** Evidence type */
    type: EvidenceType;
    /** Title/name */
    title: string;
    /** Description */
    description: string;
    /** Collection timestamp */
    collectedAt: Date;
    /** Collected by */
    collectedBy: string;
    /** Chain of custody started */
    chainOfCustodyStarted: Date;
    /** Current custodian */
    currentCustodian: string;
    /** Storage location */
    storageLocation: string;
    /** Hash of evidence (for integrity) */
    hash: string;
    /** Hash algorithm used */
    hashAlgorithm: 'sha256' | 'sha384' | 'sha512';
    /** Is evidence encrypted */
    isEncrypted: boolean;
    /** File size in bytes */
    fileSizeBytes?: number;
    /** Source system */
    sourceSystem: string;
    /** Retention required until */
    retentionUntil: Date;
    /** Chain of custody log */
    chainOfCustodyLog: Array<{
        timestamp: Date;
        action: 'collected' | 'transferred' | 'accessed' | 'copied' | 'stored';
        fromPerson?: string;
        toPerson: string;
        reason: string;
        signature?: string;
    }>;
}
export declare const preservedEvidenceSchema: z.ZodObject<{
    id: z.ZodString;
    type: z.ZodEnum<["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"]>;
    title: z.ZodString;
    description: z.ZodString;
    collectedAt: z.ZodDate;
    collectedBy: z.ZodString;
    chainOfCustodyStarted: z.ZodDate;
    currentCustodian: z.ZodString;
    storageLocation: z.ZodString;
    hash: z.ZodString;
    hashAlgorithm: z.ZodEnum<["sha256", "sha384", "sha512"]>;
    isEncrypted: z.ZodBoolean;
    fileSizeBytes: z.ZodOptional<z.ZodNumber>;
    sourceSystem: z.ZodString;
    retentionUntil: z.ZodDate;
    chainOfCustodyLog: z.ZodArray<z.ZodObject<{
        timestamp: z.ZodDate;
        action: z.ZodEnum<["collected", "transferred", "accessed", "copied", "stored"]>;
        fromPerson: z.ZodOptional<z.ZodString>;
        toPerson: z.ZodString;
        reason: z.ZodString;
        signature: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        reason?: string;
        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
        signature?: string;
        fromPerson?: string;
        toPerson?: string;
    }, {
        timestamp?: Date;
        reason?: string;
        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
        signature?: string;
        fromPerson?: string;
        toPerson?: string;
    }>, "many">;
}, "strip", z.ZodTypeAny, {
    id?: string;
    type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
    title?: string;
    description?: string;
    hash?: string;
    retentionUntil?: Date;
    collectedAt?: Date;
    collectedBy?: string;
    hashAlgorithm?: "sha256" | "sha384" | "sha512";
    isEncrypted?: boolean;
    chainOfCustodyStarted?: Date;
    currentCustodian?: string;
    storageLocation?: string;
    fileSizeBytes?: number;
    sourceSystem?: string;
    chainOfCustodyLog?: {
        timestamp?: Date;
        reason?: string;
        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
        signature?: string;
        fromPerson?: string;
        toPerson?: string;
    }[];
}, {
    id?: string;
    type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
    title?: string;
    description?: string;
    hash?: string;
    retentionUntil?: Date;
    collectedAt?: Date;
    collectedBy?: string;
    hashAlgorithm?: "sha256" | "sha384" | "sha512";
    isEncrypted?: boolean;
    chainOfCustodyStarted?: Date;
    currentCustodian?: string;
    storageLocation?: string;
    fileSizeBytes?: number;
    sourceSystem?: string;
    chainOfCustodyLog?: {
        timestamp?: Date;
        reason?: string;
        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
        signature?: string;
        fromPerson?: string;
        toPerson?: string;
    }[];
}>;
/**
 * Notification record
 */
export interface IncidentNotification {
    /** Unique identifier */
    id: string;
    /** Recipient type */
    recipient: NotificationRecipient;
    /** Recipient name */
    recipientName: string;
    /** Recipient email/contact */
    recipientContact: string;
    /** Notification method */
    method: 'email' | 'phone' | 'portal' | 'secure-message';
    /** Notification time */
    sentAt: Date;
    /** Sent by */
    sentBy: string;
    /** Content summary */
    contentSummary: string;
    /** Acknowledgment received */
    acknowledgmentReceived?: boolean;
    /** Acknowledgment time */
    acknowledgmentTime?: Date;
    /** Tracking number (e.g., US-CERT ticket) */
    trackingNumber?: string;
    /** Follow-up required */
    followUpRequired: boolean;
    /** Follow-up date */
    followUpDate?: Date;
}
export declare const incidentNotificationSchema: z.ZodObject<{
    id: z.ZodString;
    recipient: z.ZodEnum<["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"]>;
    recipientName: z.ZodString;
    recipientContact: z.ZodString;
    method: z.ZodEnum<["email", "phone", "portal", "secure-message"]>;
    sentAt: z.ZodDate;
    sentBy: z.ZodString;
    contentSummary: z.ZodString;
    acknowledgmentReceived: z.ZodOptional<z.ZodBoolean>;
    acknowledgmentTime: z.ZodOptional<z.ZodDate>;
    trackingNumber: z.ZodOptional<z.ZodString>;
    followUpRequired: z.ZodBoolean;
    followUpDate: z.ZodOptional<z.ZodDate>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    method?: "email" | "phone" | "portal" | "secure-message";
    sentAt?: Date;
    recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
    recipientName?: string;
    recipientContact?: string;
    sentBy?: string;
    contentSummary?: string;
    acknowledgmentReceived?: boolean;
    acknowledgmentTime?: Date;
    trackingNumber?: string;
    followUpRequired?: boolean;
    followUpDate?: Date;
}, {
    id?: string;
    method?: "email" | "phone" | "portal" | "secure-message";
    sentAt?: Date;
    recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
    recipientName?: string;
    recipientContact?: string;
    sentBy?: string;
    contentSummary?: string;
    acknowledgmentReceived?: boolean;
    acknowledgmentTime?: Date;
    trackingNumber?: string;
    followUpRequired?: boolean;
    followUpDate?: Date;
}>;
/**
 * Security incident record
 */
export interface SecurityIncident {
    /** Unique identifier */
    id: string;
    /** Incident title */
    title: string;
    /** Detailed description */
    description: string;
    /** Incident category */
    category: IncidentCategory;
    /** Current status */
    status: IncidentStatus;
    /** Detection timestamp */
    detectedAt: Date;
    /** Detection method */
    detectionMethod: string;
    /** Detected by */
    detectedBy: string;
    /** Incident commander/handler */
    incidentHandler: string;
    /** Affected systems */
    affectedSystems: string[];
    /** Affected data types */
    affectedDataTypes: string[];
    /** Estimated affected users/records */
    estimatedImpact?: {
        usersAffected?: number;
        recordsAffected?: number;
        systemsAffected: number;
    };
    /** Is PII involved */
    piiInvolved: boolean;
    /** Is PHI involved */
    phiInvolved: boolean;
    /** Root cause (when known) */
    rootCause?: string;
    /** Attack vector (when known) */
    attackVector?: string;
    /** Indicators of compromise */
    iocs: Array<{
        type: 'ip' | 'domain' | 'hash' | 'email' | 'url' | 'other';
        value: string;
        description?: string;
    }>;
    /** Timeline of events */
    timeline: Array<{
        timestamp: Date;
        event: string;
        actor?: string;
    }>;
    /** Notifications sent */
    notifications: IncidentNotification[];
    /** Preserved evidence */
    evidence: PreservedEvidence[];
    /** Containment actions taken */
    containmentActions: Array<{
        timestamp: Date;
        action: string;
        performedBy: string;
        result: string;
    }>;
    /** Eradication actions taken */
    eradicationActions: Array<{
        timestamp: Date;
        action: string;
        performedBy: string;
        result: string;
    }>;
    /** Recovery actions taken */
    recoveryActions: Array<{
        timestamp: Date;
        action: string;
        performedBy: string;
        result: string;
    }>;
    /** Lessons learned (post-incident) */
    lessonsLearned?: string;
    /** Recommendations */
    recommendations?: string[];
    /** Related POA&M IDs */
    relatedPOAMIds?: string[];
    /** Closure date */
    closedAt?: Date;
    /** Closure notes */
    closureNotes?: string;
    /** Reporting deadline */
    reportingDeadline: Date;
    /** Is reported to US-CERT */
    reportedToUSCERT: boolean;
    /** US-CERT ticket number */
    usCertTicketNumber?: string;
    /** Is reported to FedRAMP */
    reportedToFedRAMP: boolean;
    /** FedRAMP notification date */
    fedrampNotificationDate?: Date;
}
export declare const securityIncidentSchema: z.ZodObject<{
    id: z.ZodString;
    title: z.ZodString;
    description: z.ZodString;
    category: z.ZodEnum<["CAT-1", "CAT-2", "CAT-3", "CAT-4", "CAT-5", "CAT-6"]>;
    status: z.ZodEnum<["detected", "reported", "investigating", "contained", "eradicated", "recovering", "closed", "post-incident-review"]>;
    detectedAt: z.ZodDate;
    detectionMethod: z.ZodString;
    detectedBy: z.ZodString;
    incidentHandler: z.ZodString;
    affectedSystems: z.ZodArray<z.ZodString, "many">;
    affectedDataTypes: z.ZodArray<z.ZodString, "many">;
    estimatedImpact: z.ZodOptional<z.ZodObject<{
        usersAffected: z.ZodOptional<z.ZodNumber>;
        recordsAffected: z.ZodOptional<z.ZodNumber>;
        systemsAffected: z.ZodNumber;
    }, "strip", z.ZodTypeAny, {
        recordsAffected?: number;
        usersAffected?: number;
        systemsAffected?: number;
    }, {
        recordsAffected?: number;
        usersAffected?: number;
        systemsAffected?: number;
    }>>;
    piiInvolved: z.ZodBoolean;
    phiInvolved: z.ZodBoolean;
    rootCause: z.ZodOptional<z.ZodString>;
    attackVector: z.ZodOptional<z.ZodString>;
    iocs: z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<["ip", "domain", "hash", "email", "url", "other"]>;
        value: z.ZodString;
        description: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        value?: string;
        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
        description?: string;
    }, {
        value?: string;
        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
        description?: string;
    }>, "many">;
    timeline: z.ZodArray<z.ZodObject<{
        timestamp: z.ZodDate;
        event: z.ZodString;
        actor: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        event?: string;
        actor?: string;
    }, {
        timestamp?: Date;
        event?: string;
        actor?: string;
    }>, "many">;
    notifications: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        recipient: z.ZodEnum<["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"]>;
        recipientName: z.ZodString;
        recipientContact: z.ZodString;
        method: z.ZodEnum<["email", "phone", "portal", "secure-message"]>;
        sentAt: z.ZodDate;
        sentBy: z.ZodString;
        contentSummary: z.ZodString;
        acknowledgmentReceived: z.ZodOptional<z.ZodBoolean>;
        acknowledgmentTime: z.ZodOptional<z.ZodDate>;
        trackingNumber: z.ZodOptional<z.ZodString>;
        followUpRequired: z.ZodBoolean;
        followUpDate: z.ZodOptional<z.ZodDate>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        method?: "email" | "phone" | "portal" | "secure-message";
        sentAt?: Date;
        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
        recipientName?: string;
        recipientContact?: string;
        sentBy?: string;
        contentSummary?: string;
        acknowledgmentReceived?: boolean;
        acknowledgmentTime?: Date;
        trackingNumber?: string;
        followUpRequired?: boolean;
        followUpDate?: Date;
    }, {
        id?: string;
        method?: "email" | "phone" | "portal" | "secure-message";
        sentAt?: Date;
        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
        recipientName?: string;
        recipientContact?: string;
        sentBy?: string;
        contentSummary?: string;
        acknowledgmentReceived?: boolean;
        acknowledgmentTime?: Date;
        trackingNumber?: string;
        followUpRequired?: boolean;
        followUpDate?: Date;
    }>, "many">;
    evidence: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        type: z.ZodEnum<["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"]>;
        title: z.ZodString;
        description: z.ZodString;
        collectedAt: z.ZodDate;
        collectedBy: z.ZodString;
        chainOfCustodyStarted: z.ZodDate;
        currentCustodian: z.ZodString;
        storageLocation: z.ZodString;
        hash: z.ZodString;
        hashAlgorithm: z.ZodEnum<["sha256", "sha384", "sha512"]>;
        isEncrypted: z.ZodBoolean;
        fileSizeBytes: z.ZodOptional<z.ZodNumber>;
        sourceSystem: z.ZodString;
        retentionUntil: z.ZodDate;
        chainOfCustodyLog: z.ZodArray<z.ZodObject<{
            timestamp: z.ZodDate;
            action: z.ZodEnum<["collected", "transferred", "accessed", "copied", "stored"]>;
            fromPerson: z.ZodOptional<z.ZodString>;
            toPerson: z.ZodString;
            reason: z.ZodString;
            signature: z.ZodOptional<z.ZodString>;
        }, "strip", z.ZodTypeAny, {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }, {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }>, "many">;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
        title?: string;
        description?: string;
        hash?: string;
        retentionUntil?: Date;
        collectedAt?: Date;
        collectedBy?: string;
        hashAlgorithm?: "sha256" | "sha384" | "sha512";
        isEncrypted?: boolean;
        chainOfCustodyStarted?: Date;
        currentCustodian?: string;
        storageLocation?: string;
        fileSizeBytes?: number;
        sourceSystem?: string;
        chainOfCustodyLog?: {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }[];
    }, {
        id?: string;
        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
        title?: string;
        description?: string;
        hash?: string;
        retentionUntil?: Date;
        collectedAt?: Date;
        collectedBy?: string;
        hashAlgorithm?: "sha256" | "sha384" | "sha512";
        isEncrypted?: boolean;
        chainOfCustodyStarted?: Date;
        currentCustodian?: string;
        storageLocation?: string;
        fileSizeBytes?: number;
        sourceSystem?: string;
        chainOfCustodyLog?: {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }[];
    }>, "many">;
    containmentActions: z.ZodArray<z.ZodObject<{
        timestamp: z.ZodDate;
        action: z.ZodString;
        performedBy: z.ZodString;
        result: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }>, "many">;
    eradicationActions: z.ZodArray<z.ZodObject<{
        timestamp: z.ZodDate;
        action: z.ZodString;
        performedBy: z.ZodString;
        result: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }>, "many">;
    recoveryActions: z.ZodArray<z.ZodObject<{
        timestamp: z.ZodDate;
        action: z.ZodString;
        performedBy: z.ZodString;
        result: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }, {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }>, "many">;
    lessonsLearned: z.ZodOptional<z.ZodString>;
    recommendations: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    relatedPOAMIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    closedAt: z.ZodOptional<z.ZodDate>;
    closureNotes: z.ZodOptional<z.ZodString>;
    reportingDeadline: z.ZodDate;
    reportedToUSCERT: z.ZodBoolean;
    usCertTicketNumber: z.ZodOptional<z.ZodString>;
    reportedToFedRAMP: z.ZodBoolean;
    fedrampNotificationDate: z.ZodOptional<z.ZodDate>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "reported" | "recovering" | "post-incident-review";
    title?: string;
    description?: string;
    category?: "CAT-1" | "CAT-2" | "CAT-3" | "CAT-4" | "CAT-5" | "CAT-6";
    timeline?: {
        timestamp?: Date;
        event?: string;
        actor?: string;
    }[];
    recommendations?: string[];
    notifications?: {
        id?: string;
        method?: "email" | "phone" | "portal" | "secure-message";
        sentAt?: Date;
        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
        recipientName?: string;
        recipientContact?: string;
        sentBy?: string;
        contentSummary?: string;
        acknowledgmentReceived?: boolean;
        acknowledgmentTime?: Date;
        trackingNumber?: string;
        followUpRequired?: boolean;
        followUpDate?: Date;
    }[];
    detectedAt?: Date;
    closedAt?: Date;
    evidence?: {
        id?: string;
        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
        title?: string;
        description?: string;
        hash?: string;
        retentionUntil?: Date;
        collectedAt?: Date;
        collectedBy?: string;
        hashAlgorithm?: "sha256" | "sha384" | "sha512";
        isEncrypted?: boolean;
        chainOfCustodyStarted?: Date;
        currentCustodian?: string;
        storageLocation?: string;
        fileSizeBytes?: number;
        sourceSystem?: string;
        chainOfCustodyLog?: {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }[];
    }[];
    rootCause?: string;
    lessonsLearned?: string;
    detectionMethod?: string;
    detectedBy?: string;
    incidentHandler?: string;
    affectedSystems?: string[];
    affectedDataTypes?: string[];
    estimatedImpact?: {
        recordsAffected?: number;
        usersAffected?: number;
        systemsAffected?: number;
    };
    piiInvolved?: boolean;
    phiInvolved?: boolean;
    attackVector?: string;
    iocs?: {
        value?: string;
        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
        description?: string;
    }[];
    containmentActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    eradicationActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    recoveryActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    relatedPOAMIds?: string[];
    closureNotes?: string;
    reportingDeadline?: Date;
    reportedToUSCERT?: boolean;
    usCertTicketNumber?: string;
    reportedToFedRAMP?: boolean;
    fedrampNotificationDate?: Date;
}, {
    id?: string;
    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "reported" | "recovering" | "post-incident-review";
    title?: string;
    description?: string;
    category?: "CAT-1" | "CAT-2" | "CAT-3" | "CAT-4" | "CAT-5" | "CAT-6";
    timeline?: {
        timestamp?: Date;
        event?: string;
        actor?: string;
    }[];
    recommendations?: string[];
    notifications?: {
        id?: string;
        method?: "email" | "phone" | "portal" | "secure-message";
        sentAt?: Date;
        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
        recipientName?: string;
        recipientContact?: string;
        sentBy?: string;
        contentSummary?: string;
        acknowledgmentReceived?: boolean;
        acknowledgmentTime?: Date;
        trackingNumber?: string;
        followUpRequired?: boolean;
        followUpDate?: Date;
    }[];
    detectedAt?: Date;
    closedAt?: Date;
    evidence?: {
        id?: string;
        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
        title?: string;
        description?: string;
        hash?: string;
        retentionUntil?: Date;
        collectedAt?: Date;
        collectedBy?: string;
        hashAlgorithm?: "sha256" | "sha384" | "sha512";
        isEncrypted?: boolean;
        chainOfCustodyStarted?: Date;
        currentCustodian?: string;
        storageLocation?: string;
        fileSizeBytes?: number;
        sourceSystem?: string;
        chainOfCustodyLog?: {
            timestamp?: Date;
            reason?: string;
            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
            signature?: string;
            fromPerson?: string;
            toPerson?: string;
        }[];
    }[];
    rootCause?: string;
    lessonsLearned?: string;
    detectionMethod?: string;
    detectedBy?: string;
    incidentHandler?: string;
    affectedSystems?: string[];
    affectedDataTypes?: string[];
    estimatedImpact?: {
        recordsAffected?: number;
        usersAffected?: number;
        systemsAffected?: number;
    };
    piiInvolved?: boolean;
    phiInvolved?: boolean;
    attackVector?: string;
    iocs?: {
        value?: string;
        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
        description?: string;
    }[];
    containmentActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    eradicationActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    recoveryActions?: {
        timestamp?: Date;
        result?: string;
        action?: string;
        performedBy?: string;
    }[];
    relatedPOAMIds?: string[];
    closureNotes?: string;
    reportingDeadline?: Date;
    reportedToUSCERT?: boolean;
    usCertTicketNumber?: string;
    reportedToFedRAMP?: boolean;
    fedrampNotificationDate?: Date;
}>;
/**
 * Incident reporting configuration
 */
export interface IncidentReportingConfig {
    /** Organization name */
    organizationName: string;
    /** System name */
    systemName: string;
    /** FedRAMP package ID */
    fedrampPackageId: string;
    /** ISSO contact */
    isso: {
        name: string;
        email: string;
        phone: string;
    };
    /** CISO contact */
    ciso: {
        name: string;
        email: string;
        phone: string;
    };
    /** US-CERT POC */
    usCertPoc: {
        name: string;
        email: string;
        phone: string;
    };
    /** FedRAMP PMO contact */
    fedrampPmoPoc: {
        name: string;
        email: string;
    };
    /** Agency ISSO contact */
    agencyIsso?: {
        name: string;
        email: string;
        phone: string;
    };
    /** Evidence retention period (days) */
    evidenceRetentionDays: number;
    /** Auto-escalation enabled */
    autoEscalation: boolean;
}
/**
 * FedRAMP Incident Reporting Service
 */
export declare class IncidentReportingService {
    private config;
    private incidents;
    constructor(config: IncidentReportingConfig);
    /**
     * Create a new incident
     */
    createIncident(incident: Omit<SecurityIncident, 'id' | 'notifications' | 'evidence' | 'containmentActions' | 'eradicationActions' | 'recoveryActions' | 'reportingDeadline' | 'reportedToUSCERT' | 'reportedToFedRAMP'>): SecurityIncident;
    /**
     * Check and alert on notification requirements
     */
    private checkNotificationRequirements;
    /**
     * Update incident status
     */
    updateStatus(incidentId: string, status: IncidentStatus, notes?: string): SecurityIncident;
    /**
     * Add containment action
     */
    addContainmentAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
    /**
     * Add eradication action
     */
    addEradicationAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
    /**
     * Add recovery action
     */
    addRecoveryAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
    /**
     * Add IOC to incident
     */
    addIOC(incidentId: string, type: 'ip' | 'domain' | 'hash' | 'email' | 'url' | 'other', value: string, description?: string): SecurityIncident;
    /**
     * Record a notification sent
     */
    recordNotification(incidentId: string, notification: Omit<IncidentNotification, 'id'>): IncidentNotification;
    /**
     * Record notification acknowledgment
     */
    recordAcknowledgment(incidentId: string, notificationId: string, trackingNumber?: string): void;
    /**
     * Get required notifications for incident
     */
    getRequiredNotifications(incidentId: string): NotificationRecipient[];
    /**
     * Get missing required notifications
     */
    getMissingNotifications(incidentId: string): NotificationRecipient[];
    /**
     * Preserve evidence
     */
    preserveEvidence(incidentId: string, evidence: Omit<PreservedEvidence, 'id' | 'chainOfCustodyLog'>): PreservedEvidence;
    /**
     * Transfer evidence custody
     */
    transferEvidence(incidentId: string, evidenceId: string, toPerson: string, reason: string): void;
    /**
     * Record evidence access
     */
    recordEvidenceAccess(incidentId: string, evidenceId: string, accessedBy: string, reason: string): void;
    /**
     * Get incident by ID
     */
    getIncident(id: string): SecurityIncident | undefined;
    /**
     * Get all incidents
     */
    getAllIncidents(filter?: {
        category?: IncidentCategory;
        status?: IncidentStatus;
        startDate?: Date;
        endDate?: Date;
        piiInvolved?: boolean;
    }): SecurityIncident[];
    /**
     * Get open incidents
     */
    getOpenIncidents(): SecurityIncident[];
    /**
     * Get incidents past reporting deadline
     */
    getOverdueReporting(): SecurityIncident[];
    /**
     * Get incidents requiring follow-up
     */
    getFollowUpRequired(): SecurityIncident[];
    /**
     * Generate incident summary for FedRAMP monthly report
     */
    generateMonthlyReport(month: Date): IncidentMonthlyReport;
    /**
     * Generate US-CERT incident report format
     */
    generateUSCERTReport(incidentId: string): USCERTIncidentReport;
}
export interface IncidentMonthlyReport {
    reportPeriod: {
        start: Date;
        end: Date;
    };
    systemName: string;
    generatedAt: Date;
    totalIncidents: number;
    byCategory: Record<IncidentCategory, number>;
    openIncidents: number;
    closedIncidents: number;
    piiIncidents: number;
    averageResolutionTimeHours: number;
    overdueReporting: number;
    incidentSummaries: Array<{
        id: string;
        title: string;
        category: IncidentCategory;
        status: IncidentStatus;
        detectedAt: Date;
        reportedToUSCERT: boolean;
        usCertTicketNumber?: string;
        piiInvolved: boolean;
    }>;
}
export interface USCERTIncidentReport {
    reportDate: Date;
    incidentCategory: IncidentCategory;
    incidentCategoryName: string;
    organizationName: string;
    systemName: string;
    fedrampPackageId: string;
    incidentDescription: string;
    dateTimeOfIncident: Date;
    dateTimeDetected: Date;
    detectionMethod: string;
    affectedSystems: string[];
    estimatedImpact?: {
        usersAffected?: number;
        recordsAffected?: number;
        systemsAffected: number;
    };
    piiInvolved: boolean;
    piiDetails: string;
    phiInvolved: boolean;
    rootCause: string;
    attackVector: string;
    indicatorsOfCompromise: Array<{
        type: string;
        value: string;
        description?: string;
    }>;
    containmentActions: string[];
    eradicationActions: string[];
    recoveryActions: string[];
    currentStatus: IncidentStatus;
    pocName: string;
    pocEmail: string;
    pocPhone: string;
}
export default IncidentReportingService;
//# sourceMappingURL=incident-reporting.d.ts.map