/**
 * SIEM Integration
 *
 * Export findings and events to enterprise SIEM platforms.
 * Supports Splunk, Microsoft Sentinel, and Datadog.
 *
 * @module integrations/siem
 */
export * from "./types.js";
export * from "./format.js";
export { SplunkClient, createSplunkClient } from "./splunk.js";
export { SentinelClient, createSentinelClient } from "./sentinel.js";
export { DatadogClient, createDatadogClient } from "./datadog.js";
import { createSplunkClient } from "./splunk.js";
import { createSentinelClient } from "./sentinel.js";
import { createDatadogClient } from "./datadog.js";
/**
 * Create a SIEM client from configuration
 */
export function createSIEMClient(config) {
    switch (config.provider) {
        case "splunk":
            return createSplunkClient({
                endpoint: config.endpoint,
                token: config.token,
                index: config.options?.index,
                sourceType: config.options?.sourceType,
                source: config.options?.source,
                host: config.options?.host,
                verifySsl: config.options?.verifySsl,
            });
        case "sentinel":
            return createSentinelClient({
                workspaceId: config.options?.workspaceId || "",
                sharedKey: config.token,
                logType: config.options?.logType,
                timeGeneratedField: config.options?.timeGeneratedField,
            });
        case "datadog":
            return createDatadogClient({
                apiKey: config.token,
                site: config.options?.site,
                service: config.options?.service,
                env: config.options?.env,
                tags: config.options?.tags,
            });
        default:
            throw new Error(`Unknown SIEM provider: ${config.provider}`);
    }
}
/**
 * SIEM client registry for managing multiple connections
 */
export class SIEMRegistry {
    clients = new Map();
    /**
     * Register a SIEM client
     */
    register(name, client) {
        this.clients.set(name, client);
    }
    /**
     * Get a registered client
     */
    get(name) {
        return this.clients.get(name);
    }
    /**
     * List all registered clients
     */
    list() {
        return Array.from(this.clients.entries()).map(([name, client]) => ({
            name,
            provider: client.provider,
        }));
    }
    /**
     * Unregister and close a client
     */
    async unregister(name) {
        const client = this.clients.get(name);
        if (client) {
            await client.close();
            this.clients.delete(name);
        }
    }
    /**
     * Close all clients
     */
    async closeAll() {
        for (const client of this.clients.values()) {
            await client.close();
        }
        this.clients.clear();
    }
}
// Global registry instance
let globalRegistry = null;
/**
 * Get the global SIEM registry
 */
export function getSIEMRegistry() {
    if (!globalRegistry) {
        globalRegistry = new SIEMRegistry();
    }
    return globalRegistry;
}
/**
 * Close the global SIEM registry
 */
export async function closeSIEMRegistry() {
    if (globalRegistry) {
        await globalRegistry.closeAll();
        globalRegistry = null;
    }
}
//# sourceMappingURL=index.js.map