/**
 * Breach Detection
 *
 * Detects potential security breaches and policy violations.
 * Implements detection rules with configurable thresholds and actions.
 *
 * Added by Pantheon Security for enterprise compliance support.
 */
import type { BreachRule, BreachAction, IncidentSeverity } from "./types.js";
/**
 * Breach detection result
 */
interface BreachDetection {
    id: string;
    detected_at: string;
    rule: BreachRule;
    event_count: number;
    window_start: string;
    window_end: string;
    actions_taken: BreachAction[];
    incident_id?: string;
    blocked: boolean;
}
/**
 * Breach Detector class
 */
export declare class BreachDetector {
    private static instance;
    private rulesFile;
    private rules;
    private eventTrackers;
    private detections;
    private loaded;
    private enabled;
    private blockedPatterns;
    private constructor();
    /**
     * Get singleton instance
     */
    static getInstance(): BreachDetector;
    /**
     * Load rules from storage
     */
    private load;
    /**
     * Save custom rules to storage
     */
    private save;
    /**
     * Check an event against all rules
     */
    checkEvent(eventPattern: string, details?: Record<string, unknown>): Promise<BreachDetection | null>;
    /**
     * Check if event pattern matches rule pattern
     */
    private matchesPattern;
    /**
     * Handle a detected breach
     */
    private handleBreach;
    /**
     * Action: Log the breach
     */
    private actionLog;
    /**
     * Action: Send alert
     */
    private actionAlert;
    /**
     * Action: Block the pattern
     */
    private actionBlock;
    /**
     * Action: Notify admin
     */
    private actionNotifyAdmin;
    /**
     * Action: Create incident
     */
    private actionCreateIncident;
    /**
     * Check if a pattern is blocked
     */
    isBlocked(pattern: string): boolean;
    /**
     * Unblock a pattern
     */
    unblock(pattern: string): boolean;
    /**
     * Get all rules
     */
    getRules(): Promise<BreachRule[]>;
    /**
     * Add a custom rule
     */
    addRule(rule: Omit<BreachRule, "id">): Promise<BreachRule>;
    /**
     * Remove a rule
     */
    removeRule(ruleId: string): Promise<boolean>;
    /**
     * Get recent detections
     */
    getRecentDetections(limit?: number): BreachDetection[];
    /**
     * Get detection statistics
     */
    getStats(): {
        enabled: boolean;
        rules_count: number;
        blocked_patterns: number;
        detections_count: number;
        by_severity: Record<IncidentSeverity, number>;
        by_rule: Record<string, number>;
    };
}
/**
 * Get the breach detector instance
 */
export declare function getBreachDetector(): BreachDetector;
/**
 * Check an event for breach detection
 */
export declare function checkForBreach(eventPattern: string, details?: Record<string, unknown>): Promise<BreachDetection | null>;
/**
 * Check if a pattern is blocked
 */
export declare function isPatternBlocked(pattern: string): boolean;
/**
 * Get breach detection rules
 */
export declare function getBreachRules(): Promise<BreachRule[]>;
export {};