import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Verifies that Threat Detection event storage (especially Guest User Anomaly) is
 * available and retaining events. An empty/unavailable store means the one control
 * that would flag anomalous guest bulk-reads is blind, so a "no anomalies" result
 * is meaningless. This complements TransactionSecurityPolicyCheck (which looks at
 * policies, not whether anomaly events are actually stored).
 */
export declare class ThreatDetectionCheck implements SecurityCheck {
    readonly id = "threat-detection";
    readonly name = "Threat Detection Event Storage";
    readonly category = "Monitoring";
    readonly description = "Verifies Real-Time Event Monitoring Threat Detection storage (Guest User Anomaly and siblings) is enabled and retaining events to detect anomalous guest bulk-access";
    run(ctx: AuditContext): Promise<CheckResult>;
}
//# sourceMappingURL=ThreatDetectionCheck.d.ts.map