import type { AuditEvent } from '../types.js';
export type ThreatDetectionConfig = {
    failureThreshold: number;
    timeWindowSeconds: number;
    enableAnomalyDetection: boolean;
};
export type ThreatAlert = {
    id: string;
    severity: 'low' | 'medium' | 'high' | 'critical';
    type: string;
    message: string;
    relatedEvents: AuditEvent[];
    detectedAt: Date;
    resolved: boolean;
};
/**
 * Threat detection and anomaly analysis
 * Phase 2: Threat detection with configurable alerts
 */
export declare class ThreatDetectionEngine {
    private readonly config;
    private readonly alerts;
    private readonly failurePatterns;
    constructor(config: ThreatDetectionConfig);
    /**
     * Analyze audit event for threats
     */
    analyzeEvent(event: AuditEvent): ThreatAlert | null;
    /**
     * Detect repeated failure patterns
     */
    private detectFailurePattern;
    /**
     * Detect unusual access patterns
     */
    private detectAnomalies;
    /**
     * Record a detected threat
     */
    recordThreat(alert: ThreatAlert): void;
    /**
     * Get threat by ID
     */
    getThreat(threatId: string): ThreatAlert | undefined;
    /**
     * Get all active threats
     */
    getActiveThreats(): ThreatAlert[];
    /**
     * Get threats by severity
     */
    getThreatsBySeverity(severity: ThreatAlert['severity']): ThreatAlert[];
    /**
     * Resolve a threat
     */
    resolveThreat(threatId: string): void;
    /**
     * Get threat summary
     */
    getThreatSummary(): Record<string, number>;
    /**
     * Clear resolved threats (maintenance)
     */
    clearResolvedThreats(): number;
}
//# sourceMappingURL=threat-detection.d.ts.map